linux-kernel - Re: [PATCH] dmaengine: idxd: Avoid unnecessary destruction of file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b4d845d8-24e3-43ce-b1d4-e121f799e26c@intel.com>
Date: Tue, 30 Jan 2024 08:34:04 -0700
From: Dave Jiang <dave.jiang@...el.com>
To: Fenghua Yu <fenghua.yu@...el.com>, Vinod Koul <vkoul@...nel.org>
CC: <dmaengine@...r.kernel.org>, linux-kernel <linux-kernel@...r.kernel.org>,
	Lijun Pan <lijun.pan@...el.com>
Subject: Re: [PATCH] dmaengine: idxd: Avoid unnecessary destruction of
 file_ida



On 1/29/24 18:39, Fenghua Yu wrote:
> file_ida is allocated during cdev open and is freed accordingly
> during cdev release. This sequence is guaranteed by driver file
> operations. Therefore, there is no need to destroy an already empty
> file_ida when the WQ cdev is removed.
> 
> Worse, ida_free() in cdev release may happen after destruction of 
> file_ida per WQ cdev. This can lead to accessing an id in file_ida
> after it has been destroyed, resulting in a kernel panic.
> 
> Remove ida_destroy(&file_ida) to address these issues.
> 
> Fixes: e6fd6d7e5f0f ("dmaengine: idxd: add a device to represent the file opened")
> Signed-off-by: Lijun Pan <lijun.pan@...el.com>
> Signed-off-by: Fenghua Yu <fenghua.yu@...el.com>

Reviewed-by: Dave Jiang <dave.jiang@...el.com>
> ---
>  drivers/dma/idxd/cdev.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
> index baa51927675c..3311c920f47a 100644
> --- a/drivers/dma/idxd/cdev.c
> +++ b/drivers/dma/idxd/cdev.c
> @@ -1272,7 +1272,6 @@ void idxd_wq_del_cdev(struct idxd_wq *wq)
>  	struct idxd_cdev *idxd_cdev;
>  
>  	idxd_cdev = wq->idxd_cdev;
> -	ida_destroy(&file_ida);
>  	wq->idxd_cdev = NULL;
>  	cdev_device_del(&idxd_cdev->cdev, cdev_dev(idxd_cdev));
>  	put_device(cdev_dev(idxd_cdev));