linux-kernel - Re: [PATCH v7] Add udmabuf misc device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180910083731.o4rryvermyighbtp@sirius.home.kraxel.org>
Date:   Mon, 10 Sep 2018 10:37:31 +0200
From:   Gerd Hoffmann <kraxel@...hat.com>
To:     Gert Wollny <gert.wollny@...labora.com>
Cc:     linux-kernel@...r.kernel.org, David Airlie <airlied@...ux.ie>,
        Tomeu Vizoso <tomeu.vizoso@...labora.com>,
        Laurent Pinchart <laurent.pinchart@...asonboard.com>,
        Daniel Vetter <daniel@...ll.ch>
Subject: Re: [PATCH v7] Add udmabuf misc device

  Hi,

> > +		fput(memfd);
> > +	}
> > +	memfd = NULL;
> Now memfd is NULL 

> > +	buf = dma_buf_export(&exp_info);
> > +	if (IS_ERR(buf)) {
> > +		ret = PTR_ERR(buf);
> > +		goto err_put_pages;
> Assume an error occured 

> > +err_put_pages:
> > +	while (pgbuf > 0)
> > +		put_page(ubuf->pages[--pgbuf]);
> > +err_free_ubuf:
> > +	fput(memfd);
> Now fput it called with NULL, and in fput this is used in 

> where the bug is signalled, so I guess fput doesn't accept a null
> pointer. 

Indeed.  Already fixed in drm-misc-next.

> I'm not sure why you set memfd to NULL at all, because on the following
> non-error path it is not used.

And in the error path it should not be user either, at least when the
error happens *after* exiting the loop, otherwise we would fput twice in
the error case.

> The other question is of course, why did dma_buf_export fail for me ...

What exactly did you try?

cheers,
  Gerd