lkml.org 
[lkml]   [2020]   [May]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: KASAN: use-after-free Read in ib_uverbs_remove_one
On Fri, May 29, 2020 at 04:31:26PM +0800, Hillf Danton wrote:
> Hold another grab to dev to prevent it from going home before work gets
> done with it.
>
> +++ b/drivers/infiniband/core/uverbs_main.c
> @@ -1152,6 +1152,8 @@ static int ib_uverbs_add_one(struct ib_d
> device->ops.mmap ? &uverbs_mmap_fops : &uverbs_fops);
> uverbs_dev->cdev.owner = THIS_MODULE;
>
> + /* pair with put_device() in ib_uverbs_remove_one() */
> + get_device(&uverbs_dev->dev);
> ret = cdev_device_add(&uverbs_dev->cdev, &uverbs_dev->dev);
> if (ret)
> goto err_uapi;

Doesn't look right, the put_device() in uverbs_remove_one() pairs with
the device_initialize() in this function.

The only thing I can think of is we called remove_once twice
somehow or had an extra put on some error path. But I couldn't find
any flow that would do either of those things

Jason

\
 
 \ /
  Last update: 2020-05-29 15:31    [W:0.773 / U:0.000 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site