Dan Carpenter <[email protected]> 于2023年5月5日周五 15:31写道：
>
> On Fri, May 05, 2023 at 12:01:17PM +0800, Zheng Hacker wrote:
> > Dear Dan,
> >
> > Thanks for your reply. I'm not so familiar with the code here. Is the
> > warning says we should check ilo_hw to see if it's not NULL?
> >
>
> Just delete the NULL check. It's impossible.
>
Thanks for your explaination.
Best regards,
Zheng
> regards,
> dan carpenter
>
> > Best regards,
> > Zheng
> >
> > Dan Carpenter <[email protected]> 于2023年5月2日周二 19:46写道：
> > >
> > > Hi Zheng,
> > >
> > > kernel test robot noticed the following build warnings:
> > >
> > > https://git-scm.com/docs/git-format-patch#_base_tree_information]
> > >
> > > url: https://github.com/intel-lab-lkp/linux/commits/Zheng-Wang/misc-hpilo-Fix-use-after-free-bug-in-ilo_remove-due-to-race-condition-with-ilo_open/20230418-005502
> > > base: char-misc/char-misc-testing
> > > patch link: https://lore.kernel.org/r/20230417165246.467723-1-zyytlz.wz%40163.com
> > > patch subject: [PATCH] misc: hpilo: Fix use after free bug in ilo_remove due to race condition with ilo_open
> > > config: i386-randconfig-m021 (https://download.01.org/0day-ci/archive/20230430/[email protected]/config)
> > > compiler: gcc-11 (Debian 11.3.0-12) 11.3.0
> > >
> > > If you fix the issue, kindly add following tag where applicable
> > > | Reported-by: kernel test robot <[email protected]>
> > > | Reported-by: Dan Carpenter <[email protected]>
> > > | Link: https://lore.kernel.org/r/[email protected]/
> > >
> > > smatch warnings:
> > > drivers/misc/hpilo.c:755 ilo_delete() warn: can 'ilo_hw' even be NULL?
> > >
> > > vim +/ilo_hw +755 drivers/misc/hpilo.c
> > >
> > > 13a22f45e6cb1e Zheng Wang 2023-04-18 749 static void ilo_delete(struct kref *kref)
> > > 13a22f45e6cb1e Zheng Wang 2023-04-18 750 {
> > > 13a22f45e6cb1e Zheng Wang 2023-04-18 751 int i, minor;
> > > 13a22f45e6cb1e Zheng Wang 2023-04-18 752 struct ilo_hwinfo *ilo_hw = container_of(kref, struct ilo_hwinfo, refcnt);
> > > 13a22f45e6cb1e Zheng Wang 2023-04-18 753 struct pci_dev *pdev = ilo_hw->ilo_dev;
> > > 89bcb05d9bbf8b David Altobelli 2008-07-02 754
> > > ebf1b764aa5cb3 Mark Rusk 2012-11-06 @755 if (!ilo_hw)
> > > ^^^^^^^
> > >
> > > ->refcnt member isn't the first struct member so this NULL check
> > > doesn't make sense. Generally checking container_of() is ugly. Some
> > > people do it and add BUILD_BUG_ON() to ensure that they're checking the
> > > first struct member but really it's best to avoid that if possible.
> > >
> > > ebf1b764aa5cb3 Mark Rusk 2012-11-06 756 return;
> > > ebf1b764aa5cb3 Mark Rusk 2012-11-06 757
> > > 89bcb05d9bbf8b David Altobelli 2008-07-02 758 clear_device(ilo_hw);
> > > 89bcb05d9bbf8b David Altobelli 2008-07-02 759
> > > 89bcb05d9bbf8b David Altobelli 2008-07-02 760 minor = MINOR(ilo_hw->cdev.dev);
> > > 98dcd59dd063dd Camuso, Tony 2012-06-10 761 for (i = minor; i < minor + max_ccb; i++)
> > > 89bcb05d9bbf8b David Altobelli 2008-07-02 762 device_destroy(ilo_class, MKDEV(ilo_major, i));
> > > 89bcb05d9bbf8b David Altobelli 2008-07-02 763
> > > 89bcb05d9bbf8b David Altobelli 2008-07-02 764 cdev_del(&ilo_hw->cdev);
> > > 9f7048412163d8 David Altobelli 2009-08-17 765 ilo_disable_interrupts(ilo_hw);
> > > 9f7048412163d8 David Altobelli 2009-08-17 766 free_irq(pdev->irq, ilo_hw);
> > > 89bcb05d9bbf8b David Altobelli 2008-07-02 767 ilo_unmap_device(pdev, ilo_hw);
> > > 89bcb05d9bbf8b David Altobelli 2008-07-02 768 pci_release_regions(pdev);
> > > bcdee04ea7ae04 Jiri Slaby 2012-09-13 769 /*
> > > bcdee04ea7ae04 Jiri Slaby 2012-09-13 770 * pci_disable_device(pdev) used to be here. But this PCI device has
> > > bcdee04ea7ae04 Jiri Slaby 2012-09-13 771 * two functions with interrupt lines connected to a single pin. The
> > > bcdee04ea7ae04 Jiri Slaby 2012-09-13 772 * other one is a USB host controller. So when we disable the PIN here
> > > bcdee04ea7ae04 Jiri Slaby 2012-09-13 773 * e.g. by rmmod hpilo, the controller stops working. It is because
> > > bcdee04ea7ae04 Jiri Slaby 2012-09-13 774 * the interrupt link is disabled in ACPI since it is not refcounted
> > > bcdee04ea7ae04 Jiri Slaby 2012-09-13 775 * yet. See acpi_pci_link_free_irq called from acpi_pci_irq_disable.
> > > bcdee04ea7ae04 Jiri Slaby 2012-09-13 776 */
> > > 89bcb05d9bbf8b David Altobelli 2008-07-02 777 kfree(ilo_hw);
> > > 98dcd59dd063dd Camuso, Tony 2012-06-10 778 ilo_hwdev[(minor / max_ccb)] = 0;
> > > 89bcb05d9bbf8b David Altobelli 2008-07-02 779 }
> > >
> > > --
> > > 0-DAY CI Kernel Test Service
> > > https://github.com/intel/lkp-tests
> > >