lkml.org 
[lkml]   [2020]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [PATCH] dmabuf: use spinlock to access dmabuf->name
Date
From: Charan Teja Kalla
> Sent: 17 June 2020 07:29
...
> >> If name is freed you will copy garbage, but the only way
> >> for that to happen is that _set_name or _release have to be called
> >> at just the right time.
> >>
> >> And the above would probably only be an issue if the set_name
> >> was called, so you will get NULL or a real name.
>
> And there exists a use-after-free to avoid which requires the lock. Say
> that memcpy() in dmabuffs_dname is in progress and in parallel _set_name
> will free the same buffer that memcpy is operating on.

If the name is being looked at while the item is being freed
you almost certainly have much bigger problems that just
the name being a 'junk' pointer.

David.

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
\
 
 \ /
  Last update: 2020-06-17 10:22    [W:0.073 / U:0.456 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site