Received-SPF: pass (google.com: domain of linux-kernel+bounces-164345-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID: <11361de9-b145-41c0-8d5e-5312cd710124@web.de>
Date: Tue, 30 Apr 2024 18:16:00 +0200
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: Chun-Yi Lee <jlee@suse.com>, linux-block@vger.kernel.org,
 kernel-janitors@vger.kernel.org, Justin Sanders <justin@coraid.com>
Cc: LKML <linux-kernel@vger.kernel.org>, Chun-Yi Lee
 <joeyli.kernel@gmail.com>, "David S. Miller" <davem@davemloft.net>,
 Jens Axboe <axboe@kernel.dk>, Kirill Korotaev <dev@openvz.org>,
 Nicolai Stange <nstange@suse.com>, Pavel Emelianov <xemul@openvz.org>
References: <20240410134858.6313-1-jlee@suse.com>
Subject: Re: [PATCH] aoe: fix the potential use-after-free problem in more
 places
Content-Language: en-GB
From: Markus Elfring <Markus.Elfring@web.de>
In-Reply-To: <20240410134858.6313-1-jlee@suse.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:5CnpBjEkO44=;NOUwE0wWY6C3XAs9dfdSuF3l0G1
 mye+FBFybE1Ez0Q9TLu/uQXgcvI2PDNfZf7NKbsOZu12tu91WxZ2qjJln4KMUsb/jxAGssclw
 6v47ZmgbrlDgoYgIEXCblrqbsyf6WupVaRZAevqZ5XqnxeUm6UvCMHn1KXatZJbDgcp3YY0J8
 VgYaSPcL0fhaja+Y4symZBTrceAzj9Wc9R7DCTOgtl60kS9ttpbP7/npEc0aJHQkOUNt9ssMr
 WrAnJePMfD8xYkxGt7L1z1U4QByMRvxAIMAPL0iFKBnmK79whELOzaUTBl2k7suNuWAh3VjjC
 ubJDVFZHjloQs5S5HQtZkGfWCHPH30ij6ErNiZXG4gTw1U3meJDFmrCM02k/9H/DpH7kgwe6y
 cj4xuqlFlUCjmE/vP1yBj3Q9XT8MQbJ16hkadIipoGVdkynj73rhwLVD3CZfdqtzyl3aRkvpX
 YLZFg9/LFa9qwu1bcUSlURfvzA5av0d568Gdz54P7HTSyLG8nsGB8OxS99c+gBeLKCU8vU2pP
 H8BBfsVQx1KI0W4E94q3zCHu3BXcXgdYsTNpswb50vtJMra2LK4k+fNCRZ6we7dGyi0+Qdtyp
 11JbDGn7FDoIrLm4UR3vXDJxfp5eli2He/8lMgC/EnFzdjzx2UI1xLY2WD0jNkrFK2LDOnF6M
 6nwoALaghu1cGMxT0bSFh+Gk8sDZx+n/5AmDDuqkg1w/9C9n6WXZDD+Kn22Cwn/GyxITFY2e1
 TgyOhbcBLHuKyvNZzetYN71oBHPJwzDLk1j4FVRkJGeduqomk59OJuUyXnuGXAxRswgSWariL
 6+/jgKFCPOQCJxBfLajxik3I1d5bfpGhYkINWVfngYfhg=

> For fixing CVE-2023-6270, f98364e92662 patch moved dev_put() from
=E2=80=A6

Please add a subject for the mentioned commit hash.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Do=
cumentation/process/submitting-patches.rst?h=3Dv6.9-rc6#n99


> This patch adds dev_hold() to those functions and also uses dev_put()
> when the skb_clone() returns NULL.

Please improve this change description with a corresponding imperative wor=
ding.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Do=
cumentation/process/submitting-patches.rst?h=3Dv6.9-rc6#n94


=E2=80=A6
> Fixes: f98364e92662 ("aoe: fix the potential use-after-free problem in
> aoecmd_cfg_pkts")

I suggest to omit a line break for this tag.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Do=
cumentation/process/submitting-patches.rst?h=3Dv6.9-rc6#n145


=E2=80=A6
> +++ b/drivers/block/aoe/aoecmd.c
=E2=80=A6
> @@ -401,7 +402,8 @@ aoecmd_ata_rw(struct aoedev *d)
>  		__skb_queue_head_init(&queue);
>  		__skb_queue_tail(&queue, skb);
>  		aoenet_xmit(&queue);
> -	}
> +	} else
> +		dev_put(f->t->ifp->nd);
>  	return 1;
>  }
>
=E2=80=A6
> @@ -617,7 +622,8 @@ probe(struct aoetgt *t)
>  		__skb_queue_head_init(&queue);
>  		__skb_queue_tail(&queue, skb);
>  		aoenet_xmit(&queue);
> -	}
> +	} else
> +		dev_put(f->t->ifp->nd);
>  }
>
>  static long
=E2=80=A6

Should curly brackets be used for both if branches in these function imple=
mentations?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Do=
cumentation/process/coding-style.rst?h=3Dv6.9-rc6#n213

Regards,
Markus