Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Feedback-ID: i56a14606:Fastmail
User-Agent: Cyrus-JMAP/3.7.0-alpha0-935-ge4ccd4c47b-fm-20220914.001-ge4ccd4c4
Mime-Version: 1.0
Message-Id: <95e9c01a-1523-4187-9d1c-3c84eb875af1@www.fastmail.com>
In-Reply-To: <20220919040251.GA302541@ubuntu>
References: <20220919040251.GA302541@ubuntu>
Date:   Mon, 19 Sep 2022 07:51:58 +0200
From:   "Arnd Bergmann" <arnd@arndb.de>
To:     "Hyunwoo Kim" <imv4bel@gmail.com>,
        "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
Cc:     linux-kernel@vger.kernel.org,
        =?UTF-8?Q?Ilpo_J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>,
        "Paul Fulghum" <paulkf@microgate.com>,
        "Dominik Brodowski" <linux@dominikbrodowski.net>
Subject: Re: [PATCH v5] char: pcmcia: synclink_cs: Fix use-after-free in mgslpc_ops
Content-Type: text/plain
Precedence: bulk

On Mon, Sep 19, 2022, at 6:02 AM, Hyunwoo Kim wrote:
> A race condition may occur if the user physically removes
> the pcmcia device while calling ioctl() for this tty device node.
>
> This is a race condition between the mgslpc_ioctl() function and
> the mgslpc_detach() function, which may eventually result in UAF.
>
> So, add a refcount check to mgslpc_detach() to free the structure
> after the tty device node is close()d.
>
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>

Reviewed-by: Arnd Bergmann <arnd@arndb.de>