Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Fri, 13 Apr 2018 09:09:18 +0200
From:   Ioan Nicu <ioan.nicu.ext@nokia.com>
To:     Alexandre Bounine <alex.bou9@gmail.com>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        Barry Wood <barry.wood@idt.com>,
        Matt Porter <mporter@kernel.crashing.org>,
        Christophe JAILLET <christophe.jaillet@wanadoo.fr>,
        Al Viro <viro@zeniv.linux.org.uk>,
        Logan Gunthorpe <logang@deltatee.com>,
        Chris Wilson <chris@chris-wilson.co.uk>,
        Tvrtko Ursulin <tvrtko.ursulin@intel.com>,
        Frank Kunz <frank.kunz@nokia.com>,
        Alexander Sverdlin <alexander.sverdlin@nokia.com>,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] rapidio: fix rio_dma_transfer error handling
Message-ID: <20180413070917.GA2794@nokia.com>
References: <20180412150605.GA31409@nokia.com>
 <20180412142803.cd235a40155503700dc73b21@linux-foundation.org>
 <d77db0b1-2cca-c0f6-987d-32ffb45cb16f@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <d77db0b1-2cca-c0f6-987d-32ffb45cb16f@gmail.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
Received-SPF: None (protection.outlook.com: nokia.com does not designate
 permitted sender hosts)
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Apr 2018 07:09:20.3102 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: c4abbf8f-e070-4f5b-eb2c-08d5a10d7b0d
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 5d471751-9675-428d-917b-70f44f9630b0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR07MB3286
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi,

On Thu, Apr 12, 2018 at 07:44:01PM -0400, Alexandre Bounine wrote:
> 
> On 2018-04-12 05:28 PM, Andrew Morton wrote:
> > On Thu, 12 Apr 2018 17:06:05 +0200 Ioan Nicu <ioan.nicu.ext@nokia.com> wrote:
> > 
> > > Some of the mport_dma_req structure members were initialized late
> > > inside the do_dma_request() function, just before submitting the
> > > request to the dma engine. But we have some error branches before
> > > that. In case of such an error, the code would return on the error
> > > path and trigger the calling of dma_req_free() with a req structure
> > > which is not completely initialized. This causes a NULL pointer
> > > dereference in dma_req_free().
> > > 
> > > This patch fixes these error branches by making sure that all
> > > necessary mport_dma_req structure members are initialized in
> > > rio_dma_transfer() immediately after the request structure gets
> > > allocated.
> > 
> > This sounds like something which someone has actually triggered in a
> > real-world situation.  So I added a cc:stable.  Please let me know if
> > that was inappropriate.
> > 
> > And please remember to always include all information regarding
> > end-user impact when fixing bugs.
> > 
> This bug fix is applicable to versions starting from v4.6

Actually, this is something I broke with my previous patch where I added a
kref to the mport_dma_req structure. Before this patch, all the error paths
were doing kfree(req) instead of kref_put(&req->refcount, dma_req_free).

Now that dma_req_free() is called, it dereferences req->dmach, which is
initialized late in do_dma_request(), so dma_req_free() could be called
with a NULL req->dmach in some cases.

Sorry if I did not make this clear enough in the description.

Regards,
Ioan