lkml.org 
[lkml]   [2022]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] misc: ocxl: fix possible double free in ocxl_file_register_afu
Date
Frederic Barrat <fbarrat@linux.ibm.com> writes:
> On 21/04/2022 00:54, Michael Ellerman wrote:
>> Hangyu Hua <hbh25y@gmail.com> writes:
>>> info_release() will be called in device_unregister() when info->dev's
>>> reference count is 0. So there is no need to call ocxl_afu_put() and
>>> kfree() again.
>>
>> Double frees are often exploitable. But it looks to me like this error
>> path is not easily reachable by an attacker.
>>
>> ocxl_file_register_afu() is only called from ocxl_probe(), and we only
>> go to err_unregister if the sysfs or cdev initialisation fails, which
>> should only happen if we hit ENOMEM, or we have a duplicate device which
>> would be a device-tree/hardware error. But maybe Fred can check more
>> closely, I don't know the driver that well.
>
> The linux devices built here are based on what is parsed on the physical
> devices. Those could be FPGAs but updating the FPGA image requires root
> privilege. In any case, duplicate AFU names are possible, that's why the
> driver adds an index (the afu->config.idx part of the name) to the linux
> device name. So we would need to mess that up in the driver as well to
> have a duplicate device name.
> So I would agree the double free is hard to hit.

Thanks for confirming.

> mpe: I think this patch can be taken as is. The "beautification" I
> talked about is just that and I don't intend to work on it except if
> something else shows up.

OK, will pick this up.

cheers

\
 
 \ /
  Last update: 2022-04-22 11:37    [W:0.142 / U:0.192 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site