Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <c9a03f08-8117-cd24-b4e3-9e097e3069f2@gmail.com>
Date:   Sun, 13 Nov 2022 11:03:20 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.10.0
Subject: Re: [PATCH v2] char: xillybus: Prevent use-after-free due to race
 condition
Content-Language: en-US
To:     Hyunwoo Kim <imv4bel@gmail.com>
Cc:     gregkh@linuxfoundation.org, arnd@arndb.de,
        linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
        stern@rowland.harvard.edu
References: <20221030094209.65916-1-eli.billauer@gmail.com>
 <20221113080558.GA5854@ubuntu>
 <2a8f59ac-9d49-ffa3-b035-809f2fac38ec@gmail.com>
 <20221113084740.GA6458@ubuntu>
From:   Eli Billauer <eli.billauer@gmail.com>
In-Reply-To: <20221113084740.GA6458@ubuntu>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 13/11/2022 10:47, Hyunwoo Kim wrote:
> And, even if the mutex_unlock(&unit_mutex); of xillybus_find_inode()
> is finally moved, xdev may be released before kref_get() is executed
> if xillyusb_disconnect() ends just before the function returns.
> (Of course, this is an extremely rare case.)
> 
> So, in xillyusb_open() we need to move kref_get() above xillybus_find_inode().

First of all, that's impossible. kref_get() is called on a member of a 
specific @xdev's struct, and it's xillybus_find_inode()'s job to find 
it. So before the call to xillybus_find_inode(), we don't know which 
@xdev it is. That's the tricky part of all this.

The solution of this submitted patch was a lock that briefly prevents 
the kref_put() of all @xdevs. The way it works is that if an @xdev is 
found by xillybus_find_inode(), it necessarily means that 
xillyusb_disconnect()'s call to xillybus_cleanup_chrdev() hasn't 
returned (yet). Therefore, holding @kref_mutex guarantees that the 
kref_put() call, which is later on, isn't reached for the @xdev that has 
been found.

If you've found a flaw in this mechanism, please be more specific about it.

Regards,
   Eli