Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Robert Richter <rrichter@marvell.com>
To:     Borislav Petkov <bp@alien8.de>
CC:     Mauro Carvalho Chehab <mchehab@kernel.org>,
        Tony Luck <tony.luck@intel.com>,
        James Morse <james.morse@arm.com>,
        "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        John Garry <john.garry@huawei.com>
Subject: Re: [PATCH] EDAC/mc: Fix use-after-free and memleaks during device
 removal
Thread-Topic: [PATCH] EDAC/mc: Fix use-after-free and memleaks during device
 removal
Thread-Index: AQHVuOxuJoJ1JfG4w0+V86tO1SdYHQ==
Date:   Sun, 22 Dec 2019 17:22:48 +0000
Message-ID: <20191222172241.t7kquivbvawlbhx6@rric.localdomain>
References: <20191218062129.7400-1-rrichter@marvell.com>
 <20191222121500.GA5485@zn.tnic>
In-Reply-To: <20191222121500.GA5485@zn.tnic>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [31.208.96.227]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: f9af29b9-e10c-4b68-835a-08d7870390ec
x-ms-traffictypediagnostic: MN2PR18MB3053:
x-microsoft-antispam-prvs: <MN2PR18MB3053AAE7DA23AA72172A4032D92F0@MN2PR18MB3053.namprd18.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:299;
x-forefront-prvs: 02596AB7DA
x-forefront-antispam-report: SFV:NSPM;SFS:(10009020)(4636009)(346002)(366004)(396003)(39850400004)(136003)(376002)(199004)(189003)(7696005)(66476007)(186003)(4326008)(16526019)(66446008)(956004)(66556008)(53546011)(6506007)(2906002)(52116002)(66946007)(26005)(1076003)(8936002)(81166006)(81156014)(478600001)(8676002)(64756008)(9686003)(55016002)(71200400001)(54906003)(5660300002)(86362001)(6916009)(316002)(4744005);DIR:OUT;SFP:1101;SCL:1;SRVR:MN2PR18MB3053;H:MN2PR18MB3408.namprd18.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
received-spf: None (protection.outlook.com: marvell.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: VArvd1k289xw9n35Le4vKd3/LgLqBGOZSd2ZC50FYwqBSuWmDLrL+CO+a7yYPPJ+VG7pKacKSoK7LhP3z3OkaCOhJNxVrlbdPDy/mjITZaTruzVlbXUHZKGwwhJnwbyIXudhH+SUjGh7y+BUTTYdvuGHoIr64WW2Kx1KHIdTvb5bU1V+Xw0Q5PbcurbTg5v3oTe6l56zIOP8O12Q3S2MpSuKazIk5yHc35XZ+e2UwES5tqpeeBQhxLheEbCdBI0K6phBhAA79pUq6Qfx7qmifXVOfSOBgKuWY0XlGxWUQqhXIj84xreZYTXll19/zV32lLMMYHMSNlFKyY+u8rIPfXxr+CD6jx3WKeW8+JRxrZDGQLoqShVCtMW6kJ8fjTbws/auWNpQlQc7zR4mrbvTcbdEhwOzTZrFTt3uyU2WB5nn9LaSaVIqDgfnxDE0cmPm
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="us-ascii"
Content-ID: <20F1B25B9BDFAD44B45069263AE244F6@namprd18.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: f9af29b9-e10c-4b68-835a-08d7870390ec
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Dec 2019 17:22:48.4234
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 70e1fb47-1155-421d-87fc-2e58f638b6e0
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: xljggWMNcyetclzThlHSmSUAxf/ZgAvsjiiljO6wz5X/K3e5KVByfPlYyq0hIZqL0NvKbCUTK8ViBe4TASpCSg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR18MB3053
X-OriginatorOrg: marvell.com
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.95,18.0.572
 definitions=2019-12-22_03:2019-12-17,2019-12-22 signatures=0
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 22.12.19 13:15:00, Borislav Petkov wrote:
> On Wed, Dec 18, 2019 at 06:22:08AM +0000, Robert Richter wrote:

> > 1) Use-after-free:
> >=20
> > On 27.11.19 17:07:33, John Garry wrote:
> > > [   22.104498] BUG: KASAN: use-after-free in
> > > edac_remove_sysfs_mci_device+0x148/0x180
> >=20
> > The use-after-free is triggered in edac_remove_sysfs_mci_device(). It
> > became an issue with commit c498afaf7df8 ("EDAC: Introduce an
> > mci_for_each_dimm() iterator").
>=20
> ... which means:
>=20
> Fixes: c498afaf7df8 ("EDAC: Introduce an mci_for_each_dimm() iterator")
>=20
> ?

Wouldn't say c498afaf7df8 is broken, it is the release code itself.
This patch reveals it. But for patch logistics use the above tag.

-Robert