Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 11 Mar 2021 14:46:45 +0000
From:   Luis Chamberlain <mcgrof@kernel.org>
To:     lyl2019@mail.ustc.edu.cn
Cc:     linux-kernel@vger.kernel.org
Subject: Re: Re: Re: [PATCH] lib/test_kmod: Fix a use after free in
 register_test_dev_kmod
Message-ID: <20210311144645.GU4332@42.do-not-panic.com>
References: <20210311080246.11635-1-lyl2019@mail.ustc.edu.cn>
 <20210311130108.GS4332@42.do-not-panic.com>
 <17bb31cd.cc46.178217c9344.Coremail.lyl2019@mail.ustc.edu.cn>
 <20210311135833.GT4332@42.do-not-panic.com>
 <7c27e8b5.cf02.17821bb6891.Coremail.lyl2019@mail.ustc.edu.cn>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <7c27e8b5.cf02.17821bb6891.Coremail.lyl2019@mail.ustc.edu.cn>
Precedence: bulk

On Thu, Mar 11, 2021 at 10:40:33PM +0800, lyl2019@mail.ustc.edu.cn wrote:
> So, register_test_dev_kmod() will return a valid and freed test_dev, and cause use after free
> in function test_kmod_init().

Without looking at the details, in trying to improve the commit log
further:

Is there a way you can reproduce a real world UAF and crash? If not why not?
What is the risk of not merging this commit into the kernel tree. This
information is useful for folks to evaluate whether or not users of this
module might want to merge this and/or backport it into their testing
kernel.

If chances of this happening are 0, then this just a theoretical issue.

  Luis