Received-SPF: pass (google.com: domain of linux-kernel+bounces-171541-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Tue, 7 May 2024 19:43:26 +0530
From: Ratheesh Kannoth <rkannoth@marvell.com>
To: Duoming Zhou <duoming@zju.edu.cn>
CC: <netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
        <linux-hams@vger.kernel.org>, <pabeni@redhat.com>, <kuba@kernel.org>,
        <edumazet@google.com>, <jreuter@yaina.de>, <dan.carpenter@linaro.org>
Subject: Re: [PATCH net v5 4/4] ax25: Change kfree() in ax25_dev_free() to
 ax25_dev_put()
Message-ID: <20240507141326.GA1050877@maili.marvell.com>
References: <cover.1715065005.git.duoming@zju.edu.cn>
 <5c61fea1b20f3c1596e4fb46282c3dedc54513a3.1715065005.git.duoming@zju.edu.cn>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <5c61fea1b20f3c1596e4fb46282c3dedc54513a3.1715065005.git.duoming@zju.edu.cn>

On 2024-05-07 at 12:33:42, Duoming Zhou (duoming@zju.edu.cn) wrote:
> The object "ax25_dev" is managed by reference counting. Thus it should
> not be directly released by a kfree() call in ax25_dev_free(). Replace
> it with a ax25_dev_put() call instead.
>
> Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs")
> Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
> ---
>  net/ax25/ax25_dev.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
> index c6ab9b0f0be..2a40c78f6a0 100644
> --- a/net/ax25/ax25_dev.c
> +++ b/net/ax25/ax25_dev.c
> @@ -195,7 +195,7 @@ void __exit ax25_dev_free(void)
>  	list_for_each_entry_safe(s, n, &ax25_dev_list, list) {
>  		netdev_put(s->dev, &s->dev_tracker);
>  		list_del(&s->list);
> -		kfree(s);
> +		ax25_dev_put(s);
The commit message "The object "ax25_dev" is managed by reference counting"
seems be not making sense here.  in case ref > 0 after the ax25_dev_put().
ax25_dev_put(s) is not initiating any mechanism to come back and recheck.

>  	}
>  	spin_unlock_bh(&ax25_dev_lock);
>  }
> --
> 2.17.1
>