Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Jia-Ju Bai <baijiaju1990@gmail.com>
Subject: [BUG] net: brocade: bna: Possible concurrency use-after-free bugs
To:     rasesh.mody@cavium.com, sudarsana.kalluru@cavium.com,
        Dept-GELinuxNICDev@cavium.com, davem@davemloft.net
Cc:     netdev@vger.kernel.org,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Message-ID: <f04fa5fa-c340-5afe-a5a1-52806c7981a3@gmail.com>
Date:   Wed, 26 Dec 2018 22:35:45 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.2.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

In drivers/net/ethernet/brocade/bna/bnad_debugfs.c, the functions 
bnad_debugfs_read_regrd() and bnad_debugfs_write_regrd() may be 
concurrently executed.

bnad_debugfs_read_regrd()
   line 293: if (!bnad->regdata)
   line 297: simple_read_from_buffer(..., bnad->regdata, ...)
   line 300: kfree(bnad->regdata)

bnad_debugfs_write_regrd()
   line 335: kfree(bnad->regdata)
   line 338: kfree(bnad->regdata)
   line 357: regbuf =  (u32 *)bnad->regdata

All these accesses to bnad->regdata are not protected by any lock.
Thus, possible concurrency use-after-free bugs may occur.

A possible fixing way is to use a lock to protect these accesses.
I am not sure about this way, so I only report the bugs.


Best wishes,
Jia-Ju Bai