Messages in this thread Patch in this message |  | | From | Yoochan Lee <> | Date | Sun, 1 Jan 2023 10:39:09 +0900 | Subject | Re: [PATCH] char: xilinx_hwicap: xilinx_hwicap: Fix use-after-free in hwicap_open |
| |
I fix an error in the previous patch.
From ac8e2271ddc68ff53279d6f8d7ae8c114f3cfbf7 Mon Sep 17 00:00:00 2001 From: Yoochan Lee <yoochan1026@gmail.com> Date: Sun, 1 Jan 2023 10:38:48 +0900 Subject: [PATCH 2/2] Fix errors in previous patch
--- drivers/char/xilinx_hwicap/xilinx_hwicap.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/char/xilinx_hwicap/xilinx_hwicap.c b/drivers/char/xilinx_hwicap/xilinx_hwicap.c index d93abd99bd37..b219ee3142dc 100644 --- a/drivers/char/xilinx_hwicap/xilinx_hwicap.c +++ b/drivers/char/xilinx_hwicap/xilinx_hwicap.c @@ -217,6 +217,7 @@ static const struct config_registers v6_config_registers = { .CTL_1 = 24, };
+static void hwicap_delete(struct kref *kref); /** * hwicap_command_desync - Send a DESYNC command to the ICAP port. * @drvdata: a pointer to the drvdata. @@ -733,6 +734,10 @@ static int hwicap_remove(struct device *dev) if (!drvdata) return 0;
+ mutex_lock(&icap_sem); + probed_devices[MINOR(dev->devt)-XHWICAP_MINOR] = 0; + mutex_unlock(&icap_sem); + kref_put(&drvdata->refcnt, hwicap_delete);
return 0; /* success */ @@ -835,10 +840,6 @@ static void hwicap_delete(struct kref *kref) iounmap(drvdata->base_address); release_mem_region(drvdata->mem_start, drvdata->mem_size); kfree(drvdata); - - mutex_lock(&icap_sem); - probed_devices[MINOR(dev->devt)-XHWICAP_MINOR] = 0; - mutex_unlock(&icap_sem); }
#ifdef CONFIG_OF -- 2.39.0 2023년 1월 1일 (일) 오전 3:26, kernel test robot <lkp@intel.com>님이 작성: > > Hi Yoochan, > > Thank you for the patch! Yet something to improve: > > [auto build test ERROR on soc/for-next] > [also build test ERROR on char-misc/char-misc-testing char-misc/char-misc-next char-misc/char-misc-linus linus/master v6.2-rc1 next-20221226] > [If your patch is applied to the wrong git tree, kindly drop us a note. > And when submitting patch, we suggest to use '--base' as documented in > https://git-scm.com/docs/git-format-patch#_base_tree_information] > > url: https://github.com/intel-lab-lkp/linux/commits/Yoochan-Lee/char-xilinx_hwicap-xilinx_hwicap-Fix-use-after-free-in-hwicap_open/20221231-112957 > base: https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git for-next > patch link: https://lore.kernel.org/r/20221231032826.2034288-1-yoochan1026%40gmail.com > patch subject: [PATCH] char: xilinx_hwicap: xilinx_hwicap: Fix use-after-free in hwicap_open > config: microblaze-randconfig-r013-20221226 > compiler: microblaze-linux-gcc (GCC) 12.1.0 > reproduce (this is a W=1 build): > wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross > chmod +x ~/bin/make.cross > # https://github.com/intel-lab-lkp/linux/commit/85568c4b21398a7da51b017dbbf78424b59f1f2f > git remote add linux-review https://github.com/intel-lab-lkp/linux > git fetch --no-tags linux-review Yoochan-Lee/char-xilinx_hwicap-xilinx_hwicap-Fix-use-after-free-in-hwicap_open/20221231-112957 > git checkout 85568c4b21398a7da51b017dbbf78424b59f1f2f > # save the config file > mkdir build_dir && cp config build_dir/.config > COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=microblaze olddefconfig > COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=microblaze SHELL=/bin/bash > > If you fix the issue, kindly add following tag where applicable > | Reported-by: kernel test robot <lkp@intel.com> > > All errors (new ones prefixed by >>): > > drivers/char/xilinx_hwicap/xilinx_hwicap.c: In function 'hwicap_release': > >> drivers/char/xilinx_hwicap/xilinx_hwicap.c:587:36: error: 'hwicap_delete' undeclared (first use in this function); did you mean 'hwicap_release'? > 587 | kref_put(&drvdata->refcnt, hwicap_delete); > | ^~~~~~~~~~~~~ > | hwicap_release > drivers/char/xilinx_hwicap/xilinx_hwicap.c:587:36: note: each undeclared identifier is reported only once for each function it appears in > drivers/char/xilinx_hwicap/xilinx_hwicap.c: In function 'hwicap_remove': > drivers/char/xilinx_hwicap/xilinx_hwicap.c:736:36: error: 'hwicap_delete' undeclared (first use in this function); did you mean 'hwicap_release'? > 736 | kref_put(&drvdata->refcnt, hwicap_delete); > | ^~~~~~~~~~~~~ > | hwicap_release > In file included from include/linux/fs.h:7, > from include/linux/huge_mm.h:8, > from include/linux/mm.h:737, > from arch/microblaze/include/asm/io.h:14, > from include/linux/io.h:13, > from include/linux/irq.h:20, > from include/asm-generic/hardirq.h:17, > from ./arch/microblaze/include/generated/asm/hardirq.h:1, > from include/linux/hardirq.h:11, > from include/linux/interrupt.h:11, > from drivers/char/xilinx_hwicap/xilinx_hwicap.c:78: > drivers/char/xilinx_hwicap/xilinx_hwicap.c: In function 'hwicap_delete': > >> drivers/char/xilinx_hwicap/xilinx_hwicap.c:840:30: error: 'dev' undeclared (first use in this function); did you mean 'cdev'? > 840 | probed_devices[MINOR(dev->devt)-XHWICAP_MINOR] = 0; > | ^~~ > include/linux/kdev_t.h:11:43: note: in definition of macro 'MINOR' > 11 | #define MINOR(dev) ((unsigned int) ((dev) & MINORMASK)) > | ^~~ > drivers/char/xilinx_hwicap/xilinx_hwicap.c: At top level: > drivers/char/xilinx_hwicap/xilinx_hwicap.c:829:13: warning: 'hwicap_delete' defined but not used [-Wunused-function] > 829 | static void hwicap_delete(struct kref *kref) > | ^~~~~~~~~~~~~ > > > vim +587 drivers/char/xilinx_hwicap/xilinx_hwicap.c > > 564 > 565 static int hwicap_release(struct inode *inode, struct file *file) > 566 { > 567 struct hwicap_drvdata *drvdata = file->private_data; > 568 int i; > 569 int status = 0; > 570 > 571 mutex_lock(&drvdata->sem); > 572 > 573 if (drvdata->write_buffer_in_use) { > 574 /* Flush write buffer. */ > 575 for (i = drvdata->write_buffer_in_use; i < 4; i++) > 576 drvdata->write_buffer[i] = 0; > 577 > 578 status = drvdata->config->set_configuration(drvdata, > 579 (u32 *) drvdata->write_buffer, 1); > 580 if (status) > 581 goto error; > 582 } > 583 > 584 status = hwicap_command_desync(drvdata); > 585 if (status) > 586 goto error; > > 587 kref_put(&drvdata->refcnt, hwicap_delete); > 588 > 589 error: > 590 drvdata->is_open = 0; > 591 mutex_unlock(&drvdata->sem); > 592 return status; > 593 } > 594 > > -- > 0-DAY CI Kernel Test Service > https://01.org/lkp
|  |