Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH v2 1/2] Revert "net: mdiobus: Fix memory leak in
 __mdiobus_register"
To:     Pavel Skripkin <paskripkin@gmail.com>, andrew@lunn.ch,
        hkallweit1@gmail.com, linux@armlinux.org.uk, davem@davemloft.net,
        kuba@kernel.org, buytenh@marvell.com, afleming@freescale.com,
        dan.carpenter@oracle.com
Cc:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20210927112017.19108-1-paskripkin@gmail.com>
 <2324212c8d0a713eba0aae3c25635b3ca5c5243f.1632861239.git.paskripkin@gmail.com>
From:   "Xu, Yanfei" <yanfei.xu@windriver.com>
Message-ID: <cf252f69-bc42-3d4d-3967-3f58f8607e93@windriver.com>
Date:   Wed, 29 Sep 2021 14:32:49 +0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.10.0
In-Reply-To: <2324212c8d0a713eba0aae3c25635b3ca5c5243f.1632861239.git.paskripkin@gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TXFta1Y1NG50VzN6WjRCVVJJcUt6TVhUaTh3UzROVm1kYnh0elc3RjRsOEhk?=
 =?utf-8?B?cUdqRmxIVXFKbGFDalV4QnpLTFNEVGpVNmlLWDBxOEx1UUZ1aDFxb3JyRGNH?=
 =?utf-8?B?TW1pbWJvcWpBdDRGeDRYV2VuR24wUU91MFRZUFFuY3Flc0kvSFIzR3JXdmRm?=
 =?utf-8?B?WUkwWC9pbXIzcE9pdlh4NFdFMWpIdFhwZlJCVUNHdWhDY2VzNVM2QWxCWWVM?=
 =?utf-8?B?Q0lFL0FGeGltYXNjK1I2dE5UQmRrRk5OSGFSQVdRdmZzRHZVb1VtcVc1THU4?=
 =?utf-8?B?MkxNQnFJcVdnYXZVVUlUTERuWm5VbGNSYVhERVNzMlowN0M4YStDSmFWQ2pN?=
 =?utf-8?B?MHdnTkRxeloycmlTbVdkdkZiYmVBLy9FMGwySmd5VFpiaGFFWjRmck9HS3NR?=
 =?utf-8?B?UTB0SHpXSTVOVE1sNitnTWNmcTROTithYjNVNkYvN0hrb3AxamlYSGVTSGYr?=
 =?utf-8?B?TVNrUHBLQVp2TDNqaHhRVG43eitaR1Y3bnNjZW1JcElDNWNmYXNkdEZsc0ZO?=
 =?utf-8?B?bVFFQ3dMN3E5cDB0V1VXV3NVdWxLdkhlVDRyU0pJQTZOd0hybGpHWnNXTTRK?=
 =?utf-8?B?Y2pmV0pXT1BQV2VqY2RCL3pXY1YxbU5Gd3JXTzlXZXVXSzRub2Fza0Y5SEFx?=
 =?utf-8?B?MlJ4YVhFc25lMzl3Z2VndkVQYndYU2xTU05Yd2dUWWlLamVYU0pGK3lOTU04?=
 =?utf-8?B?U2VPNGYvOTIyN3NZSGQ3ckloTGRZNkRhdmNxdVlKbTFoRXZrcFNkZDIwWCtR?=
 =?utf-8?B?OFVONU95czMzenNlSndqa3Q4eUpuNEg0M0lRN3k3a0VwZThPVWFPU2N3dXQw?=
 =?utf-8?B?RUwwRVVzWEVJL0Zmb1RxN3ZGSlEyaWthcEwvc0FJaHBPU3lrei9Ka0srbmVG?=
 =?utf-8?B?YTZZaG5iTFRYSVBVVUhFOU5GL1J2VXAvK0xxSERmMERQUTJtMVl0VG1WMC9v?=
 =?utf-8?B?UGV4SFFqQ0crY1NHdE1zNjlmd01YYXJWZzRGZklJNUJ1bzl1TEhiSHQrQ3I2?=
 =?utf-8?B?OG01aXZ5blJFZFl4Nml5emlEVTd5ZFVacXg1eEt5LzE5ZFVjQ2MzME9Vd2Jl?=
 =?utf-8?B?RHhFbVgyemhMNkt0U0RveFRRekFhZ05yeklZRXNYQ2MrYWRRWnRESU5TWkNm?=
 =?utf-8?B?SmRTN1Z5cy9jOTBWajJaanhwdFoxRTc4d3NPcWdOM3NIdFkzWXl3dU4zcDlw?=
 =?utf-8?B?YXRKOVJsMVNjVDBib3RvUnNsV3hST0RaeFNrS3Jydno1NGdkLzk4VHh6STM5?=
 =?utf-8?B?VW11S25vdklPdEdxVU56K1hvWW9uSlFKL0VuR2VCZEdhMThkOUQ3OHFDbUlw?=
 =?utf-8?B?WXo5SGtVWWxlc0JmV01Jb05GSktsUk1ibjhIV0x0NUtaSlF4YWxaRmtCOTdN?=
 =?utf-8?B?c24ra08zK0ZJWkRiNFp4bmRJZ1h3YmlZUTM4K2szckg2TGdNQWlKSzVaWSsx?=
 =?utf-8?B?MFoxa3prU3hnSUFwMW5MNWJZelZ2ZzNxaFBZQW1HRElwL25Sa3NyOFYrbWNB?=
 =?utf-8?B?VVV2Q2hMWElhVUsrdFRXV0hVb09ucjY5c29keWRPZTY0bFZYQ0JSOXVodUhm?=
 =?utf-8?B?RDdEWkZDT1c3QXdIQXNON3AvTkFvdmVhVk8xSTdsaWpBdXNSMlpyZUlCdlFR?=
 =?utf-8?B?V0N6R0ZNYWU0Vmw0SXFjTDROTjhpb001blM0emJwYmNQUjh1UW5vVkhKaHk0?=
 =?utf-8?B?bHdFaWhCb1hyNHNBY1NienF4V29UbXNyNW1tcHc3eGszUHo3WXdUNEtISUtH?=
 =?utf-8?Q?CIdnidWdirllvZe0k3KUkJs6jrHNXaJpvLQ3gdv?=
X-OriginatorOrg: windriver.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 18afbf62-4a0d-4510-f57c-08d98312fab8
X-MS-Exchange-CrossTenant-AuthSource: DM8PR11MB5734.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Sep 2021 06:32:58.9726
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 0dlhFwF2JqKWg3iCqV6xdlXyo0G8tZnV7lVdMFzYSPBirSsVO8dqYnVlMA0+xlgEEFzCmv6/H930cWMAMulNCw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB4692
X-Proofpoint-GUID: yS-XlynpM6IEKPMH-9BmUhD2mNck-qd6
X-Proofpoint-ORIG-GUID: yS-XlynpM6IEKPMH-9BmUhD2mNck-qd6
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.182.1,Aquarius:18.0.790,Hydra:6.0.391,FMLib:17.0.607.475
 definitions=2021-09-29_02,2021-09-28_01,2020-04-07_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 bulkscore=0
 priorityscore=1501 spamscore=0 suspectscore=0 mlxlogscore=911 adultscore=0
 phishscore=0 impostorscore=0 lowpriorityscore=0 malwarescore=0
 clxscore=1011 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2109230001 definitions=main-2109290038
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 9/29/21 4:39 AM, Pavel Skripkin wrote:
> This reverts commit ab609f25d19858513919369ff3d9a63c02cd9e2e.
> 
> This patch is correct in the sense that we_should_  call device_put() in
> case of device_register() failure, but the problem in this code is more
> vast.
> 
> We need to set bus->state to UNMDIOBUS_REGISTERED before calling
> device_register() to correctly release the device in mdiobus_free().
> This patch prevents us from doing it, since in case of device_register()
> failure put_device() will be called 2 times and it will cause UAF or
> something else.
> 
> Also, Reported-by: tag in revered commit was wrong, since syzbot
> reported different leak in same function.
> 
> Link:https://lore.kernel.org/netdev/20210928092657.GI2048@kadam/
> Cc: Yanfei Xu<yanfei.xu@windriver.com>
> Signed-off-by: Pavel Skripkin<paskripkin@gmail.com>
> ---
> 
> Changes in v2:
>          Added this revert


Acked-by: Yanfei Xu<yanfei.xu@windriver.com>

Thanks,
Yanfei