Messages in this thread Patch in this message |  | | From | Yoochan Lee <> | Date | Sat, 31 Dec 2022 18:49:34 +0900 | Subject | Re: [PATCH] misc: phantom: Fix use-after-free in phantom_open |
| |
I missed the error in my patches.
Here is the fixed version of the patches.
From c6fb094d3dcf7c4441924cb0a56ba739ed3b2d44 Mon Sep 17 00:00:00 2001 From: Yoochan Lee <yoochan1026@gmail.com> Date: Sat, 31 Dec 2022 18:49:03 +0900 Subject: [PATCH 2/2] fix error in previous patches
--- drivers/misc/phantom.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/phantom.c b/drivers/misc/phantom.c index ee75aa1f56ae..37c26e728be1 100644 --- a/drivers/misc/phantom.c +++ b/drivers/misc/phantom.c @@ -55,6 +55,7 @@ struct phantom_device { /* used in NOT_OH mode */ struct phm_regs oregs; u32 ctl_reg; + struct pci_dev *pdev; struct kref refcnt; };
@@ -82,6 +83,8 @@ static int phantom_status(struct phantom_device *dev, unsigned long newstat) static void phantom_delete(struct kref *kref) { struct phantom_device *pht = container_of(kref, struct phantom_device, refcnt); + struct pci_dev *pdev = pht->pdev; + unsigned int minor = MINOR(pht->cdev.dev);
device_destroy(phantom_class, MKDEV(phantom_major, minor));
@@ -414,6 +417,7 @@ static int phantom_probe(struct pci_dev *pdev, mutex_init(&pht->open_lock); spin_lock_init(&pht->regs_lock); kref_init(&pht->refcnt); + pht->pdev = pdev; init_waitqueue_head(&pht->wait); cdev_init(&pht->cdev, &phantom_file_ops); pht->cdev.owner = THIS_MODULE; @@ -464,7 +468,6 @@ static int phantom_probe(struct pci_dev *pdev, static void phantom_remove(struct pci_dev *pdev) { struct phantom_device *pht = pci_get_drvdata(pdev); - unsigned int minor = MINOR(pht->cdev.dev);
kref_put(&pht->refcnt, phantom_delete); } -- 2.39.0 2022년 12월 31일 (토) 오후 6:31, kernel test robot <lkp@intel.com>님이 작성:
> > Hi Yoochan, > > Thank you for the patch! Perhaps something to improve: > > [auto build test WARNING on char-misc/char-misc-testing] > [also build test WARNING on char-misc/char-misc-next char-misc/char-misc-linus soc/for-next linus/master v6.2-rc1 next-20221226] > [If your patch is applied to the wrong git tree, kindly drop us a note. > And when submitting patch, we suggest to use '--base' as documented in > https://git-scm.com/docs/git-format-patch#_base_tree_information] > > url: https://github.com/intel-lab-lkp/linux/commits/Yoochan-Lee/misc-phantom-Fix-use-after-free-in-phantom_open/20221231-140519 > patch link: https://lore.kernel.org/r/20221231060459.2041173-1-yoochan1026%40gmail.com > patch subject: [PATCH] misc: phantom: Fix use-after-free in phantom_open > config: x86_64-allyesconfig > compiler: gcc-11 (Debian 11.3.0-8) 11.3.0 > reproduce (this is a W=1 build): > # https://github.com/intel-lab-lkp/linux/commit/350dcfa1ef8b394d79ef66c82a0ec66b813708ef > git remote add linux-review https://github.com/intel-lab-lkp/linux > git fetch --no-tags linux-review Yoochan-Lee/misc-phantom-Fix-use-after-free-in-phantom_open/20221231-140519 > git checkout 350dcfa1ef8b394d79ef66c82a0ec66b813708ef > # save the config file > mkdir build_dir && cp config build_dir/.config > make W=1 O=build_dir ARCH=x86_64 olddefconfig > make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/ > > If you fix the issue, kindly add following tag where applicable > | Reported-by: kernel test robot <lkp@intel.com> > > All warnings (new ones prefixed by >>): > > In file included from include/linux/fs.h:7, > from include/linux/compat.h:17, > from drivers/misc/phantom.c:11: > drivers/misc/phantom.c: In function 'phantom_delete': > drivers/misc/phantom.c:86:60: error: 'minor' undeclared (first use in this function); did you mean 'iminor'? > 86 | device_destroy(phantom_class, MKDEV(phantom_major, minor)); > | ^~~~~ > include/linux/kdev_t.h:12:49: note: in definition of macro 'MKDEV' > 12 | #define MKDEV(ma,mi) (((ma) << MINORBITS) | (mi)) > | ^~ > drivers/misc/phantom.c:86:60: note: each undeclared identifier is reported only once for each function it appears in > 86 | device_destroy(phantom_class, MKDEV(phantom_major, minor)); > | ^~~~~ > include/linux/kdev_t.h:12:49: note: in definition of macro 'MKDEV' > 12 | #define MKDEV(ma,mi) (((ma) << MINORBITS) | (mi)) > | ^~ > drivers/misc/phantom.c:92:18: error: 'pdev' undeclared (first use in this function); did you mean 'cdev'? > 92 | free_irq(pdev->irq, pht); > | ^~~~ > | cdev > drivers/misc/phantom.c: In function 'phantom_remove': > >> drivers/misc/phantom.c:467:22: warning: unused variable 'minor' [-Wunused-variable] > 467 | unsigned int minor = MINOR(pht->cdev.dev); > | ^~~~~ > > > vim +/minor +467 drivers/misc/phantom.c > > cef2cf07273d12 Jiri Slaby 2007-05-08 463 > 486a5c28c2e7d6 Bill Pemberton 2012-11-19 464 static void phantom_remove(struct pci_dev *pdev) > cef2cf07273d12 Jiri Slaby 2007-05-08 465 { > cef2cf07273d12 Jiri Slaby 2007-05-08 466 struct phantom_device *pht = pci_get_drvdata(pdev); > cef2cf07273d12 Jiri Slaby 2007-05-08 @467 unsigned int minor = MINOR(pht->cdev.dev); > cef2cf07273d12 Jiri Slaby 2007-05-08 468 > 350dcfa1ef8b39 Yoochan Lee 2022-12-31 469 kref_put(&pht->refcnt, phantom_delete); > cef2cf07273d12 Jiri Slaby 2007-05-08 470 } > cef2cf07273d12 Jiri Slaby 2007-05-08 471 > > -- > 0-DAY CI Kernel Test Service > https://01.org/lkp
|  |