linux-kernel - Re: [PATCH] misc: phantom: Fix use-after-free in phantom

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202212311714.gS30xDjv-lkp@intel.com>
Date:   Sat, 31 Dec 2022 17:30:27 +0800
From:   kernel test robot <lkp@...el.com>
To:     Yoochan Lee <yoochan1026@...il.com>, jirislaby@...nel.org
Cc:     oe-kbuild-all@...ts.linux.dev, arnd@...db.de,
        gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org,
        Yoochan Lee <yoochan1026@...il.com>
Subject: Re: [PATCH] misc: phantom: Fix use-after-free in phantom_open

Hi Yoochan,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on char-misc/char-misc-testing]
[also build test WARNING on char-misc/char-misc-next char-misc/char-misc-linus soc/for-next linus/master v6.2-rc1 next-20221226]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Yoochan-Lee/misc-phantom-Fix-use-after-free-in-phantom_open/20221231-140519
patch link:    https://lore.kernel.org/r/20221231060459.2041173-1-yoochan1026%40gmail.com
patch subject: [PATCH] misc: phantom: Fix use-after-free in phantom_open
config: x86_64-allyesconfig
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
reproduce (this is a W=1 build):
        # https://github.com/intel-lab-lkp/linux/commit/350dcfa1ef8b394d79ef66c82a0ec66b813708ef
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review Yoochan-Lee/misc-phantom-Fix-use-after-free-in-phantom_open/20221231-140519
        git checkout 350dcfa1ef8b394d79ef66c82a0ec66b813708ef
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        make W=1 O=build_dir ARCH=x86_64 olddefconfig
        make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@...el.com>

All warnings (new ones prefixed by >>):

   In file included from include/linux/fs.h:7,
                    from include/linux/compat.h:17,
                    from drivers/misc/phantom.c:11:
   drivers/misc/phantom.c: In function 'phantom_delete':
   drivers/misc/phantom.c:86:60: error: 'minor' undeclared (first use in this function); did you mean 'iminor'?
      86 |         device_destroy(phantom_class, MKDEV(phantom_major, minor));
         |                                                            ^~~~~
   include/linux/kdev_t.h:12:49: note: in definition of macro 'MKDEV'
      12 | #define MKDEV(ma,mi)    (((ma) << MINORBITS) | (mi))
         |                                                 ^~
   drivers/misc/phantom.c:86:60: note: each undeclared identifier is reported only once for each function it appears in
      86 |         device_destroy(phantom_class, MKDEV(phantom_major, minor));
         |                                                            ^~~~~
   include/linux/kdev_t.h:12:49: note: in definition of macro 'MKDEV'
      12 | #define MKDEV(ma,mi)    (((ma) << MINORBITS) | (mi))
         |                                                 ^~
   drivers/misc/phantom.c:92:18: error: 'pdev' undeclared (first use in this function); did you mean 'cdev'?
      92 |         free_irq(pdev->irq, pht);
         |                  ^~~~
         |                  cdev
   drivers/misc/phantom.c: In function 'phantom_remove':
>> drivers/misc/phantom.c:467:22: warning: unused variable 'minor' [-Wunused-variable]
     467 |         unsigned int minor = MINOR(pht->cdev.dev);
         |                      ^~~~~


vim +/minor +467 drivers/misc/phantom.c

cef2cf07273d12 Jiri Slaby     2007-05-08  463  
486a5c28c2e7d6 Bill Pemberton 2012-11-19  464  static void phantom_remove(struct pci_dev *pdev)
cef2cf07273d12 Jiri Slaby     2007-05-08  465  {
cef2cf07273d12 Jiri Slaby     2007-05-08  466  	struct phantom_device *pht = pci_get_drvdata(pdev);
cef2cf07273d12 Jiri Slaby     2007-05-08 @467  	unsigned int minor = MINOR(pht->cdev.dev);
cef2cf07273d12 Jiri Slaby     2007-05-08  468  
350dcfa1ef8b39 Yoochan Lee    2022-12-31  469  	kref_put(&pht->refcnt, phantom_delete);
cef2cf07273d12 Jiri Slaby     2007-05-08  470  }
cef2cf07273d12 Jiri Slaby     2007-05-08  471  

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp

View attachment "config" of type "text/plain" (294653 bytes)