Date:   Sat, 31 Dec 2022 19:21:36 +0800
From:   kernel test robot <lkp@...el.com>
To:     Yoochan Lee <yoochan1026@...il.com>, jirislaby@...nel.org
Cc:     llvm@...ts.linux.dev, oe-kbuild-all@...ts.linux.dev, arnd@...db.de,
        gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org,
        Yoochan Lee <yoochan1026@...il.com>
Subject: Re: [PATCH] misc: phantom: Fix use-after-free in phantom_open

Hi Yoochan,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on char-misc/char-misc-testing]
[also build test ERROR on char-misc/char-misc-next char-misc/char-misc-linus soc/for-next linus/master v6.2-rc1 next-20221226]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Yoochan-Lee/misc-phantom-Fix-use-after-free-in-phantom_open/20221231-140519
patch link:    https://lore.kernel.org/r/20221231060459.2041173-1-yoochan1026%40gmail.com
patch subject: [PATCH] misc: phantom: Fix use-after-free in phantom_open
config: x86_64-randconfig-a005-20221226
compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/intel-lab-lkp/linux/commit/350dcfa1ef8b394d79ef66c82a0ec66b813708ef
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review Yoochan-Lee/misc-phantom-Fix-use-after-free-in-phantom_open/20221231-140519
        git checkout 350dcfa1ef8b394d79ef66c82a0ec66b813708ef
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 olddefconfig
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/misc/

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@...el.com>

All error/warnings (new ones prefixed by >>):

>> drivers/misc/phantom.c:86:53: error: use of undeclared identifier 'minor'; did you mean 'iminor'?
           device_destroy(phantom_class, MKDEV(phantom_major, minor));
                                                              ^~~~~
                                                              iminor
   include/linux/kdev_t.h:12:46: note: expanded from macro 'MKDEV'
   #define MKDEV(ma,mi)    (((ma) << MINORBITS) | (mi))
                                                   ^
   include/linux/fs.h:890:24: note: 'iminor' declared here
   static inline unsigned iminor(const struct inode *inode)
                          ^
>> drivers/misc/phantom.c:86:32: error: invalid operands to binary expression ('int' and 'unsigned int (const struct inode *)')
           device_destroy(phantom_class, MKDEV(phantom_major, minor));
                                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/kdev_t.h:12:43: note: expanded from macro 'MKDEV'
   #define MKDEV(ma,mi)    (((ma) << MINORBITS) | (mi))
                            ~~~~~~~~~~~~~~~~~~~ ^ ~~~~
>> drivers/misc/phantom.c:92:11: error: use of undeclared identifier 'pdev'
           free_irq(pdev->irq, pht);
                    ^
   drivers/misc/phantom.c:94:14: error: use of undeclared identifier 'pdev'
           pci_iounmap(pdev, pht->oaddr);
                       ^
   drivers/misc/phantom.c:95:14: error: use of undeclared identifier 'pdev'
           pci_iounmap(pdev, pht->iaddr);
                       ^
   drivers/misc/phantom.c:96:14: error: use of undeclared identifier 'pdev'
           pci_iounmap(pdev, pht->caddr);
                       ^
   drivers/misc/phantom.c:100:22: error: use of undeclared identifier 'pdev'
           pci_release_regions(pdev);
                               ^
   drivers/misc/phantom.c:102:18: error: use of undeclared identifier 'minor'; did you mean 'iminor'?
           phantom_devices[minor] = 0;
                           ^~~~~
                           iminor
   include/linux/fs.h:890:24: note: 'iminor' declared here
   static inline unsigned iminor(const struct inode *inode)
                          ^
>> drivers/misc/phantom.c:102:17: error: array subscript is not an integer
           phantom_devices[minor] = 0;
                          ^~~~~~
   drivers/misc/phantom.c:104:21: error: use of undeclared identifier 'pdev'
           pci_disable_device(pdev);
                              ^
>> drivers/misc/phantom.c:467:15: warning: unused variable 'minor' [-Wunused-variable]
           unsigned int minor = MINOR(pht->cdev.dev);
                        ^
   1 warning and 10 errors generated.


vim +86 drivers/misc/phantom.c

    81	
    82	static void phantom_delete(struct kref *kref)
    83	{
    84		struct phantom_device *pht = container_of(kref, struct phantom_device, refcnt);
    85	
  > 86		device_destroy(phantom_class, MKDEV(phantom_major, minor));
    87	
    88		cdev_del(&pht->cdev);
    89	
    90		iowrite32(0, pht->caddr + PHN_IRQCTL);
    91		ioread32(pht->caddr + PHN_IRQCTL); /* PCI posting */
  > 92		free_irq(pdev->irq, pht);
    93	
    94		pci_iounmap(pdev, pht->oaddr);
    95		pci_iounmap(pdev, pht->iaddr);
    96		pci_iounmap(pdev, pht->caddr);
    97	
    98		kfree(pht);
    99	
   100		pci_release_regions(pdev);
   101	
 > 102		phantom_devices[minor] = 0;
   103	
   104		pci_disable_device(pdev);
   105	

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp

View attachment "config" of type "text/plain" (174264 bytes)

Powered by blists - more mailing lists