Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20221231060459.2041173-1-yoochan1026@gmail.com> <202212311714.gS30xDjv-lkp@intel.com>
In-Reply-To: <202212311714.gS30xDjv-lkp@intel.com>
From:   Yoochan Lee <yoochan1026@gmail.com>
Date:   Sat, 31 Dec 2022 18:49:34 +0900
Message-ID: <CALQpDLe1buF47SyVToD6R4Dp1vyOYOhPquEEsijRhHxi3evMdQ@mail.gmail.com>
Subject: Re: [PATCH] misc: phantom: Fix use-after-free in phantom_open
To:     kernel test robot <lkp@intel.com>
Cc:     jirislaby@kernel.org, oe-kbuild-all@lists.linux.dev, arnd@arndb.de,
        gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

I missed the error in my patches.

Here is the fixed version of the patches.


From c6fb094d3dcf7c4441924cb0a56ba739ed3b2d44 Mon Sep 17 00:00:00 2001
From: Yoochan Lee <yoochan1026@gmail.com>
Date: Sat, 31 Dec 2022 18:49:03 +0900
Subject: [PATCH 2/2] fix error in previous patches

---
 drivers/misc/phantom.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/phantom.c b/drivers/misc/phantom.c
index ee75aa1f56ae..37c26e728be1 100644
--- a/drivers/misc/phantom.c
+++ b/drivers/misc/phantom.c
@@ -55,6 +55,7 @@ struct phantom_device {
  /* used in NOT_OH mode */
  struct phm_regs oregs;
  u32 ctl_reg;
+ struct pci_dev *pdev;
  struct kref refcnt;
 };

@@ -82,6 +83,8 @@ static int phantom_status(struct phantom_device
*dev, unsigned long newstat)
 static void phantom_delete(struct kref *kref)
 {
  struct phantom_device *pht =3D container_of(kref, struct
phantom_device, refcnt);
+ struct pci_dev *pdev =3D pht->pdev;
+ unsigned int minor =3D MINOR(pht->cdev.dev);

  device_destroy(phantom_class, MKDEV(phantom_major, minor));

@@ -414,6 +417,7 @@ static int phantom_probe(struct pci_dev *pdev,
  mutex_init(&pht->open_lock);
  spin_lock_init(&pht->regs_lock);
  kref_init(&pht->refcnt);
+ pht->pdev =3D pdev;
  init_waitqueue_head(&pht->wait);
  cdev_init(&pht->cdev, &phantom_file_ops);
  pht->cdev.owner =3D THIS_MODULE;
@@ -464,7 +468,6 @@ static int phantom_probe(struct pci_dev *pdev,
 static void phantom_remove(struct pci_dev *pdev)
 {
  struct phantom_device *pht =3D pci_get_drvdata(pdev);
- unsigned int minor =3D MINOR(pht->cdev.dev);

  kref_put(&pht->refcnt, phantom_delete);
 }
--
2.39.0

2022=EB=85=84 12=EC=9B=94 31=EC=9D=BC (=ED=86=A0) =EC=98=A4=ED=9B=84 6:31, =
kernel test robot <lkp@intel.com>=EB=8B=98=EC=9D=B4 =EC=9E=91=EC=84=B1:


>
> Hi Yoochan,
>
> Thank you for the patch! Perhaps something to improve:
>
> [auto build test WARNING on char-misc/char-misc-testing]
> [also build test WARNING on char-misc/char-misc-next char-misc/char-misc-=
linus soc/for-next linus/master v6.2-rc1 next-20221226]
> [If your patch is applied to the wrong git tree, kindly drop us a note.
> And when submitting patch, we suggest to use '--base' as documented in
> https://git-scm.com/docs/git-format-patch#_base_tree_information]
>
> url:    https://github.com/intel-lab-lkp/linux/commits/Yoochan-Lee/misc-p=
hantom-Fix-use-after-free-in-phantom_open/20221231-140519
> patch link:    https://lore.kernel.org/r/20221231060459.2041173-1-yoochan=
1026%40gmail.com
> patch subject: [PATCH] misc: phantom: Fix use-after-free in phantom_open
> config: x86_64-allyesconfig
> compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
> reproduce (this is a W=3D1 build):
>         # https://github.com/intel-lab-lkp/linux/commit/350dcfa1ef8b394d7=
9ef66c82a0ec66b813708ef
>         git remote add linux-review https://github.com/intel-lab-lkp/linu=
x
>         git fetch --no-tags linux-review Yoochan-Lee/misc-phantom-Fix-use=
-after-free-in-phantom_open/20221231-140519
>         git checkout 350dcfa1ef8b394d79ef66c82a0ec66b813708ef
>         # save the config file
>         mkdir build_dir && cp config build_dir/.config
>         make W=3D1 O=3Dbuild_dir ARCH=3Dx86_64 olddefconfig
>         make W=3D1 O=3Dbuild_dir ARCH=3Dx86_64 SHELL=3D/bin/bash drivers/
>
> If you fix the issue, kindly add following tag where applicable
> | Reported-by: kernel test robot <lkp@intel.com>
>
> All warnings (new ones prefixed by >>):
>
>    In file included from include/linux/fs.h:7,
>                     from include/linux/compat.h:17,
>                     from drivers/misc/phantom.c:11:
>    drivers/misc/phantom.c: In function 'phantom_delete':
>    drivers/misc/phantom.c:86:60: error: 'minor' undeclared (first use in =
this function); did you mean 'iminor'?
>       86 |         device_destroy(phantom_class, MKDEV(phantom_major, min=
or));
>          |                                                            ^~~=
~~
>    include/linux/kdev_t.h:12:49: note: in definition of macro 'MKDEV'
>       12 | #define MKDEV(ma,mi)    (((ma) << MINORBITS) | (mi))
>          |                                                 ^~
>    drivers/misc/phantom.c:86:60: note: each undeclared identifier is repo=
rted only once for each function it appears in
>       86 |         device_destroy(phantom_class, MKDEV(phantom_major, min=
or));
>          |                                                            ^~~=
~~
>    include/linux/kdev_t.h:12:49: note: in definition of macro 'MKDEV'
>       12 | #define MKDEV(ma,mi)    (((ma) << MINORBITS) | (mi))
>          |                                                 ^~
>    drivers/misc/phantom.c:92:18: error: 'pdev' undeclared (first use in t=
his function); did you mean 'cdev'?
>       92 |         free_irq(pdev->irq, pht);
>          |                  ^~~~
>          |                  cdev
>    drivers/misc/phantom.c: In function 'phantom_remove':
> >> drivers/misc/phantom.c:467:22: warning: unused variable 'minor' [-Wunu=
sed-variable]
>      467 |         unsigned int minor =3D MINOR(pht->cdev.dev);
>          |                      ^~~~~
>
>
> vim +/minor +467 drivers/misc/phantom.c
>
> cef2cf07273d12 Jiri Slaby     2007-05-08  463
> 486a5c28c2e7d6 Bill Pemberton 2012-11-19  464  static void phantom_remove=
(struct pci_dev *pdev)
> cef2cf07273d12 Jiri Slaby     2007-05-08  465  {
> cef2cf07273d12 Jiri Slaby     2007-05-08  466   struct phantom_device *ph=
t =3D pci_get_drvdata(pdev);
> cef2cf07273d12 Jiri Slaby     2007-05-08 @467   unsigned int minor =3D MI=
NOR(pht->cdev.dev);
> cef2cf07273d12 Jiri Slaby     2007-05-08  468
> 350dcfa1ef8b39 Yoochan Lee    2022-12-31  469   kref_put(&pht->refcnt, ph=
antom_delete);
> cef2cf07273d12 Jiri Slaby     2007-05-08  470  }
> cef2cf07273d12 Jiri Slaby     2007-05-08  471
>
> --
> 0-DAY CI Kernel Test Service
> https://01.org/lkp