Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 6 Jun 2023 10:18:16 +0200
From:   Simon Horman <simon.horman@corigine.com>
To:     Ben Hutchings <ben@decadent.org.uk>
Cc:     netdev@vger.kernel.org, Thomas Gleixner <tglx@linutronix.de>,
        linux-kernel@vger.kernel.org, Eli Cohen <elic@nvidia.com>
Subject: Re: [PATCH net] lib: cpu_rmap: Fix potential use-after-free in
 irq_cpu_rmap_release()
Message-ID: <ZH7ryEA+5WlSRW4m@corigine.com>
References: <ZHo0vwquhOy3FaXc@decadent.org.uk>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <ZHo0vwquhOy3FaXc@decadent.org.uk>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?VvuNOsACbgO3UUBnNGarxYxgGwmSaEnTaAC7ap4qRwD3v4uvsGu34O0M7GU1?=
 =?us-ascii?Q?OIbnHdGkRTsp1IpeBtqkXyG5DWY05rdCpaMbXTbuI8+cJa7NvDLgicMICjp+?=
 =?us-ascii?Q?cSBAKVOpEMCNlVz1u8ep6tGJATJl3zBYGpPA5MwF/rtZk+M8c0xBYgFvKqgK?=
 =?us-ascii?Q?XwcBmJJrBsTrjvvpOpBtZK4/ceWm47iPvzn5OfX17VWulwiRgCcE5JI6luhC?=
 =?us-ascii?Q?YPyBMVOdWwSgM8dhEHQIB2qOPTqUHwSMIgB4YBykvVZvDOwhfgX7hF83/fj/?=
 =?us-ascii?Q?D8lbmM1YwZaRtcdVk0ZnjTW2GxC+soil8qkpdJJDTaaNzxT29QRbwJlb9rHk?=
 =?us-ascii?Q?ImnKKqd+sXAT/X2q1as393XyzIxiIiyHx28f3RjtYqRovOHp52fXswzRXj0p?=
 =?us-ascii?Q?T4DMdlZjvDQqBjMHMD/4wrzaM7e20eloI0syD5gVE+LeoMwlesvin7KhvFlb?=
 =?us-ascii?Q?LL4yL2zNFN+yUnT2O2h1pLYcQV3ahvNp9U8cQJB1UciAh9HNtKocbCCw/K7U?=
 =?us-ascii?Q?B3SbuOYvo0npD+gQAZHnxYDx16y0j1Bpe4ZbuA1rgW5y8lCSuLuFA4pnpxlJ?=
 =?us-ascii?Q?BE/cCe9R3nvo3Ig0s83bw0IhGMoEauFkr4twmzvWDEDRJC8diMcZQ0Ndmd3H?=
 =?us-ascii?Q?q721bIyEUCkSpHTa3RCvgA9ueQgJNa0uN+CJE+hJfJSXW1DPSbalf63PlP3k?=
 =?us-ascii?Q?eVdL6+B4d82XxDQNX8mmc0NW3dfMWKyul3BwIACyIbkrzAN4n6FBrUT+19j0?=
 =?us-ascii?Q?r2ypHk5DKASYoNBjR/OmtSVprswemq7g8UCWzcbvEfJ0iqIlqgDEeSCmkn6j?=
 =?us-ascii?Q?ECJTvSRo2gC5kJA1MoKxRI1hRn1suSDdMDoVWlIBhrDfzJNtuFW1HNps4bpF?=
 =?us-ascii?Q?jtDHQ7TQ+9+AB6KADGu5YgPvvEgQH0UWEXJPEMyW+BuE4fIhbx3GmThLknBT?=
 =?us-ascii?Q?qwaVTd4Z4IO0+8hflCX/xykDToaR+nvuEP4KbdPxdpN7aL8eBg3iIYdrTRpw?=
 =?us-ascii?Q?Z0BZQgZE5RQ4c8Pt9ksPWkELHuzivWj5J4C98I2PhFx5YihBvI11vi9x5x2V?=
 =?us-ascii?Q?0Eg06PnM/P6QoxFPnaNcorP8X+21A0UikNh0wPLAHj5PWIrcQVsGUpQ1ReqG?=
 =?us-ascii?Q?ZyEfGC+We8a/eFh5/1zjwfA2dEfjvYD299ETTHHzfVwpigu2T1JGSunAlaAJ?=
 =?us-ascii?Q?XmwSylKZcIVmXGn/wQAgrYFrfXchErHGIn+A+5ZI3a1T0S7r6fcMidoV7bdH?=
 =?us-ascii?Q?+8NrSWZre1ipDK2QrAoh+Qz6jYW7y8CaMKWDXvUYLprfm7POrehvNXebDu3J?=
 =?us-ascii?Q?EwAISlbnTyua4Bo+l7rUkhb5be4Qmnk5eJyRhHR7QFlsAIxulYRhYfPVOpJU?=
 =?us-ascii?Q?VZlET+97tCjGoHRhKLhj4pnfX2/w+hLTUiTtQMrwwtbEMnwQZ6Qfc2WTSHzj?=
 =?us-ascii?Q?ngRo+sr/NaNws3aBfHVTZeFrzxHxdfgwtKhqHr0zzyFlIwHnA70L/2Np3dd5?=
 =?us-ascii?Q?ClB0FU+3DqMiqjQqskdOTkPLM+KdIWMM4KVPyFoKJKCA6xQDFxGcBIYucMtY?=
 =?us-ascii?Q?EgwBz4Jap6EzzZoKpq/hvegxwRMTrWv/n0GdpKX2RFTzCVfwmpTRiqPyqNOA?=
 =?us-ascii?Q?KvyBtfZHjejkSULvEktE7v8HEH08MxKYDEBL/+PpFRBM2vgLQylUgUwBDSfM?=
 =?us-ascii?Q?l6eGIw=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1f7cd05f-81ed-4a84-c1b1-08db666697bf
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Jun 2023 08:18:22.2964
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: XebKMLaC6/zziPxQKheWabjodvYwfQrXdCy1HTmN/B5O4EIDbZf8xy1+an11OnKpqnU9roHRVQR4QpA/GF+9RIKyT1tmIC7VRyEL1oBxNzM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR13MB3720
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Jun 02, 2023 at 08:28:15PM +0200, Ben Hutchings wrote:
> irq_cpu_rmap_release() calls cpu_rmap_put(), which may free the rmap.
> So we need to clear the pointer to our glue structure in rmap before
> doing that, not after.
> 
> Fixes: 4e0473f1060a ("lib: cpu_rmap: Avoid use after free on rmap->obj ...")
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

Reviewed-by: Simon Horman <simon.horman@corigine.com>