Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <aaa7960e-11cb-e5aa-d1c3-499c3353133d@linaro.org>
Date:   Wed, 13 Apr 2022 11:39:50 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.7.0
Subject: Re: [PATCH] NFC: NULL out the dev->rfkill to prevent UAF
Content-Language: en-US
To:     Lin Ma <linma@zju.edu.cn>, davem@davemloft.net, kuba@kernel.org,
        pabeni@redhat.com, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20220412053208.28681-1-linma@zju.edu.cn>
From:   Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
In-Reply-To: <20220412053208.28681-1-linma@zju.edu.cn>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 12/04/2022 07:32, Lin Ma wrote:
> Commit 3e3b5dfcd16a ("NFC: reorder the logic in nfc_{un,}register_device") 
> assumes the device_is_registered() in function nfc_dev_up() will help
> to check when the rfkill is unregistered. However, this check only 
> take effect when device_del(&dev->dev) is done in nfc_unregister_device().
> Hence, the rfkill object is still possible be dereferenced.
> 


Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>


Best regards,
Krzysztof