Received-SPF: pass (google.com: domain of linux-kernel+bounces-78515-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Message-ID: <3cbe7ad1-421a-493c-9cb2-9234e139923f@kernel.dk>
Date: Fri, 23 Feb 2024 07:43:08 -0700
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] usb: gadget: f_fs: Fix NULL pointer dereference in
 ffs_epfile_async_io_complete()
Content-Language: en-US
To: Selvarasu Ganesan <quic_selvaras@quicinc.com>,
 Greg KH <gregkh@linuxfoundation.org>
Cc: brauner@kernel.org, jack@suse.cz, jlayton@kernel.org,
 keescook@chromium.org, peter@korsgaard.com, hayama@lineo.co.jp,
 dmantipov@yandex.ru, quic_linyyuan@quicinc.com, linux-usb@vger.kernel.org,
 linux-kernel@vger.kernel.org, quic_ppratap@quicinc.com,
 quic_wcheng@quicinc.com, quic_jackp@quicinc.com
References: <20240223054809.2379-1-quic_selvaras@quicinc.com>
 <2024022302-routine-schematic-b4fd@gregkh>
 <d2f40e2d-cbbd-41f9-9aa6-41d0f251ffda@quicinc.com>
From: Jens Axboe <axboe@kernel.dk>
In-Reply-To: <d2f40e2d-cbbd-41f9-9aa6-41d0f251ffda@quicinc.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

On 2/23/24 4:35 AM, Selvarasu Ganesan wrote:
> Here?s what the code might look like with a new lock:
> 
> static void ffs_epfile_async_io_complete(struct usb_ep *_ep,
>                                          struct usb_request *req)
> {
> ....
> spin_lock(&ffs->new_lock);
> if (ffs && ffs->io_completion_wq)
>     queue_work(ffs->io_completion_wq, &io_data->work);
> spin_unlock(&ffs->new_lock);
> ....
> }
> 
> 
> 
> static void ffs_data_put(struct ffs_data *ffs) {
> ...
> destroy_workqueue(ffs->io_completion_wq);
> kfree(ffs->dev_name);
> spin_lock(&ffs->new_lock);
> kfree(ffs);
> spin_unlock(&ffs->new_lock);
> ...
> }

This obviously won't work at all, and it's not the right way to fix it
at all. It needs a ref count.

-- 
Jens Axboe