linux-kernel - Re: Re: [PATCH] thunderbolt: Fix a double put in tb_cfg_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4ff4aeb5.e6c7.1785f7e4edc.Coremail.lyl2019@mail.ustc.edu.cn>
Date:   Tue, 23 Mar 2021 22:30:16 +0800 (GMT+08:00)
From:   lyl2019@...l.ustc.edu.cn
To:     "Mika Westerberg" <mika.westerberg@...ux.intel.com>
Cc:     andreas.noever@...il.com, michael.jamet@...el.com,
        YehezkelShB@...il.com, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: Re: [PATCH] thunderbolt: Fix a double put in tb_cfg_read_raw




> -----原始邮件-----
> 发件人: "Mika Westerberg" <mika.westerberg@...ux.intel.com>
> 发送时间: 2021-03-23 22:06:47 (星期二)
> 收件人: "Lv Yunlong" <lyl2019@...l.ustc.edu.cn>
> 抄送: andreas.noever@...il.com, michael.jamet@...el.com, YehezkelShB@...il.com, linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
> 主题: Re: [PATCH] thunderbolt: Fix a double put in tb_cfg_read_raw
> 
> Hi,
> 
> On Mon, Mar 22, 2021 at 08:15:12PM -0700, Lv Yunlong wrote:
> > In tb_cfg_read_raw, req is allocated by tb_cfg_request_alloc()
> > with an initial reference. Before calling tb_cfg_request_sync(),
> > there is no refcount inc operation. tb_cfg_request_sync()
> > calls tb_cfg_request(..,req,..) and if the callee failed,
> > the initial reference of req is dropped and req is freed.
> > 
> > Later in tb_cfg_read_raw before the err check,
> > tb_cfg_request_put(req) is called again. It may cause error
> > in race.
> 
> Hmm, tb_cfg_request() does tb_cfg_request_get() too and in case of error
> it does tb_cfg_request_put(). So the refcount should be fine. What am I
> missing?
> 
> > 
> > My patch puts tb_cfg_request_put(req) after the err check
> > finished to avoid unexpected result.
> > 
> > Signed-off-by: Lv Yunlong <lyl2019@...l.ustc.edu.cn>
> > ---
> >  drivers/thunderbolt/ctl.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/thunderbolt/ctl.c b/drivers/thunderbolt/ctl.c
> > index f1aeaff9f368..bb60269c89ab 100644
> > --- a/drivers/thunderbolt/ctl.c
> > +++ b/drivers/thunderbolt/ctl.c
> > @@ -890,11 +890,11 @@ struct tb_cfg_result tb_cfg_read_raw(struct tb_ctl *ctl, void *buffer,
> >  
> >  		res = tb_cfg_request_sync(ctl, req, timeout_msec);
> >  
> > -		tb_cfg_request_put(req);
> > -
> >  		if (res.err != -ETIMEDOUT)
> >  			break;
> >  
> > +		tb_cfg_request_put(req);
> > +
> >  		/* Wait a bit (arbitrary time) until we send a retry */
> >  		usleep_range(10, 100);
> >  	}
> > -- 
> > 2.25.1
> > 

I'm very sorry, i was ashamed that i had missed the tb_cfg_request_get() in tb_cfg_request().

Thanks.