Received: by 2002:a05:6358:53a8:b0:117:f937:c515 with SMTP id z40csp4318225rwe; Mon, 17 Apr 2023 10:47:40 -0700 (PDT) X-Google-Smtp-Source: AKy350bdKQJGNXw8uyOJEGgWEV8tOJmF4/r0JEP0DzAFwceK0Bfk5/XXtbeh121ISP93W7fULGVG X-Received: by 2002:a17:90a:a093:b0:246:a782:d94 with SMTP id r19-20020a17090aa09300b00246a7820d94mr15659134pjp.7.1681753660610; Mon, 17 Apr 2023 10:47:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1681753660; cv=none; d=google.com; s=arc-20160816; b=0iKbs33aL5y1rNunpom51LDADdpXtOwho9wjN7XPUHSormZ7xaBhv1GXw1kh2cV4+w 6tmWMG4ZhC2NqY/DQCQzW3db4ZdZnPyGWqsXVxirnXP4OcJrthOKVdv+J69ebWwl0FVH 543IsQ5Tz5TXVNEfu+FrNZzbDTuRQcYmNXKi4Zsw7OhpV6nI6C+gpxh01MjvXxHj3d1+ VylXNLlnVeKzed4bUgWLOGtncNgXRwRbTLs9rlhFBxx143wiRMia55Xwbd4akUiXxeS/ H3a9gV79DqfjrdDt12eg4SziRFNZW+w+spi06srKIfSmS8tW7qX+4Tp0wNr54tT5m4zz kr2Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:in-reply-to:content-disposition:mime-version :references:message-id:subject:cc:to:from:date:dkim-signature; bh=Ww9LpFdLsZOfndNyCMKbxYprr2vlQJN6aYFUV4Ac6TA=; b=uymLkqnSFM+lUb/oM1NPYRECkYkaRVMDLnsnvb6TB+8o6RZGXVLtj4K8jZxjBmcCSV KXggFYUXgEWz6yQ2Nj+k8YXrYbtwK8emmBoF2KXOj9NsliPHZ9G/aTxjC1hEIKxBcwQc s0iEIatJJM+mgob5pHfKju+E89QBZWvA6dON/39Io7ysycD4fmqkAEBcbaMLfsiFiYTb XwgkJ6sKofJC9PMu4E6i9+3t4BQ6vLiWfCaCxKYqL32j32yzGVC9ppS0hX93JfSUbw12 C5FXcERFnAdUl5L6x49gPNRWijCq3/YGT3sqdl3f7d/UuJE8B38/SK41viOT5jDImNrL pRKA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=EsX7K1QJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id n21-20020a17090ac69500b0023f2e6a146bsi10786337pjt.41.2023.04.17.10.47.29; Mon, 17 Apr 2023 10:47:40 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=EsX7K1QJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230483AbjDQRnq (ORCPT + 99 others); Mon, 17 Apr 2023 13:43:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38368 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230317AbjDQRnj (ORCPT ); Mon, 17 Apr 2023 13:43:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DE8475BBA for ; Mon, 17 Apr 2023 10:43:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 71CEF625A1 for ; Mon, 17 Apr 2023 17:43:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 46A47C433EF; Mon, 17 Apr 2023 17:43:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1681753417; bh=bqXpMLlD0td0ig89u8H6WzZBOrc1ov9qI+aDKXYS8pM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=EsX7K1QJ0qj65NWc6vW4dybtIX5fnxmEzI0MQge4jmUA4CS1d2Buo2GHaSHiPfjyw ITusv4n6swtIQMFnsKQ9CmmdyK/lREYc92BAf+b2K+zWQCG0n2LE5w83CRvct1B7OA Q58szXhKAxPPdpD2C30Hm4lj1lAxU1XKEcdkWcQo= Date: Mon, 17 Apr 2023 19:43:35 +0200 From: Greg KH To: Zheng Wang Cc: matt.hsiao@hpe.com, arnd@arndb.de, linux-kernel@vger.kernel.org, hackerzheng666@gmail.com, 1395428693sheep@gmail.com, alex000young@gmail.com Subject: Re: [PATCH] misc: hpilo: Fix use after free bug in ilo_remove due to race condition with ilo_open Message-ID: <2023041756-scoop-splendor-0e01@gregkh> References: <20230417165246.467723-1-zyytlz.wz@163.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230417165246.467723-1-zyytlz.wz@163.com> X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Apr 18, 2023 at 12:52:46AM +0800, Zheng Wang wrote: > --- a/drivers/misc/hpilo.h > +++ b/drivers/misc/hpilo.h > @@ -62,6 +62,7 @@ struct ilo_hwinfo { > spinlock_t fifo_lock; > > struct cdev cdev; > + struct kref refcnt; You now have 2 different structures doing reference counting logic on the same structure. That's just not ok at all, and is totally broken. greg k-h