| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 31 Dec 2022 18:49:34 +0900
From: Yoochan Lee <yoochan1026@...il.com>
To: kernel test robot <lkp@...el.com>
Cc: jirislaby@...nel.org, oe-kbuild-all@...ts.linux.dev, arnd@...db.de,
gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] misc: phantom: Fix use-after-free in phantom_open
I missed the error in my patches.
Here is the fixed version of the patches.
>From c6fb094d3dcf7c4441924cb0a56ba739ed3b2d44 Mon Sep 17 00:00:00 2001
From: Yoochan Lee <yoochan1026@...il.com>
Date: Sat, 31 Dec 2022 18:49:03 +0900
Subject: [PATCH 2/2] fix error in previous patches
---
drivers/misc/phantom.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/phantom.c b/drivers/misc/phantom.c
index ee75aa1f56ae..37c26e728be1 100644
--- a/drivers/misc/phantom.c
+++ b/drivers/misc/phantom.c
@@ -55,6 +55,7 @@ struct phantom_device {
/* used in NOT_OH mode */
struct phm_regs oregs;
u32 ctl_reg;
+ struct pci_dev *pdev;
struct kref refcnt;
};
@@ -82,6 +83,8 @@ static int phantom_status(struct phantom_device
*dev, unsigned long newstat)
static void phantom_delete(struct kref *kref)
{
struct phantom_device *pht = container_of(kref, struct
phantom_device, refcnt);
+ struct pci_dev *pdev = pht->pdev;
+ unsigned int minor = MINOR(pht->cdev.dev);
device_destroy(phantom_class, MKDEV(phantom_major, minor));
@@ -414,6 +417,7 @@ static int phantom_probe(struct pci_dev *pdev,
mutex_init(&pht->open_lock);
spin_lock_init(&pht->regs_lock);
kref_init(&pht->refcnt);
+ pht->pdev = pdev;
init_waitqueue_head(&pht->wait);
cdev_init(&pht->cdev, &phantom_file_ops);
pht->cdev.owner = THIS_MODULE;
@@ -464,7 +468,6 @@ static int phantom_probe(struct pci_dev *pdev,
static void phantom_remove(struct pci_dev *pdev)
{
struct phantom_device *pht = pci_get_drvdata(pdev);
- unsigned int minor = MINOR(pht->cdev.dev);
kref_put(&pht->refcnt, phantom_delete);
}
--
2.39.0
2022년 12월 31일 (토) 오후 6:31, kernel test robot <lkp@...el.com>님이 작성:
>
> Hi Yoochan,
>
> Thank you for the patch! Perhaps something to improve:
>
> [auto build test WARNING on char-misc/char-misc-testing]
> [also build test WARNING on char-misc/char-misc-next char-misc/char-misc-linus soc/for-next linus/master v6.2-rc1 next-20221226]
> [If your patch is applied to the wrong git tree, kindly drop us a note.
> And when submitting patch, we suggest to use '--base' as documented in
> https://git-scm.com/docs/git-format-patch#_base_tree_information]
>
> url: https://github.com/intel-lab-lkp/linux/commits/Yoochan-Lee/misc-phantom-Fix-use-after-free-in-phantom_open/20221231-140519
> patch link: https://lore.kernel.org/r/20221231060459.2041173-1-yoochan1026%40gmail.com
> patch subject: [PATCH] misc: phantom: Fix use-after-free in phantom_open
> config: x86_64-allyesconfig
> compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
> reproduce (this is a W=1 build):
> # https://github.com/intel-lab-lkp/linux/commit/350dcfa1ef8b394d79ef66c82a0ec66b813708ef
> git remote add linux-review https://github.com/intel-lab-lkp/linux
> git fetch --no-tags linux-review Yoochan-Lee/misc-phantom-Fix-use-after-free-in-phantom_open/20221231-140519
> git checkout 350dcfa1ef8b394d79ef66c82a0ec66b813708ef
> # save the config file
> mkdir build_dir && cp config build_dir/.config
> make W=1 O=build_dir ARCH=x86_64 olddefconfig
> make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/
>
> If you fix the issue, kindly add following tag where applicable
> | Reported-by: kernel test robot <lkp@...el.com>
>
> All warnings (new ones prefixed by >>):
>
> In file included from include/linux/fs.h:7,
> from include/linux/compat.h:17,
> from drivers/misc/phantom.c:11:
> drivers/misc/phantom.c: In function 'phantom_delete':
> drivers/misc/phantom.c:86:60: error: 'minor' undeclared (first use in this function); did you mean 'iminor'?
> 86 | device_destroy(phantom_class, MKDEV(phantom_major, minor));
> | ^~~~~
> include/linux/kdev_t.h:12:49: note: in definition of macro 'MKDEV'
> 12 | #define MKDEV(ma,mi) (((ma) << MINORBITS) | (mi))
> | ^~
> drivers/misc/phantom.c:86:60: note: each undeclared identifier is reported only once for each function it appears in
> 86 | device_destroy(phantom_class, MKDEV(phantom_major, minor));
> | ^~~~~
> include/linux/kdev_t.h:12:49: note: in definition of macro 'MKDEV'
> 12 | #define MKDEV(ma,mi) (((ma) << MINORBITS) | (mi))
> | ^~
> drivers/misc/phantom.c:92:18: error: 'pdev' undeclared (first use in this function); did you mean 'cdev'?
> 92 | free_irq(pdev->irq, pht);
> | ^~~~
> | cdev
> drivers/misc/phantom.c: In function 'phantom_remove':
> >> drivers/misc/phantom.c:467:22: warning: unused variable 'minor' [-Wunused-variable]
> 467 | unsigned int minor = MINOR(pht->cdev.dev);
> | ^~~~~
>
>
> vim +/minor +467 drivers/misc/phantom.c
>
> cef2cf07273d12 Jiri Slaby 2007-05-08 463
> 486a5c28c2e7d6 Bill Pemberton 2012-11-19 464 static void phantom_remove(struct pci_dev *pdev)
> cef2cf07273d12 Jiri Slaby 2007-05-08 465 {
> cef2cf07273d12 Jiri Slaby 2007-05-08 466 struct phantom_device *pht = pci_get_drvdata(pdev);
> cef2cf07273d12 Jiri Slaby 2007-05-08 @467 unsigned int minor = MINOR(pht->cdev.dev);
> cef2cf07273d12 Jiri Slaby 2007-05-08 468
> 350dcfa1ef8b39 Yoochan Lee 2022-12-31 469 kref_put(&pht->refcnt, phantom_delete);
> cef2cf07273d12 Jiri Slaby 2007-05-08 470 }
> cef2cf07273d12 Jiri Slaby 2007-05-08 471
>
> --
> 0-DAY CI Kernel Test Service
> https://01.org/lkp
Powered by blists - more mailing lists