From: Greg KH <gregkh@linuxfoundation.org>
To: Charan Teja Kalla <charante@codeaurora.org>
Cc: dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org,
linux-kernel@vger.kernel.org, vinmenon@codeaurora.org,
sumit.semwal@linaro.org, ghackmann@google.com, fengc@google.com,
linux-media@vger.kernel.org
Subject: Re: [PATCH] dma-buf: fix use-after-free in dmabuffs_dname
Date: Tue, 12 May 2020 10:45:34 +0200 [thread overview]
Message-ID: <20200512084534.GA3557007@kroah.com> (raw)
In-Reply-To: <3bc8dd81-f298-aea0-f218-2e2ef12ca603@codeaurora.org>
On Tue, May 12, 2020 at 10:43:18AM +0530, Charan Teja Kalla wrote:
> > Ok, but watch out, now you have 2 different reference counts for the
> > same structure. Keeping them coordinated is almost always an impossible
> > task so you need to only rely on one. If you can't use the file api,
> > just drop all of the reference counting logic in there and only use the
> > kref one.
>
> I feel that changing the refcount logic now to dma-buf objects involve
> changes in
>
> the core dma-buf framework. NO? Instead, how about passing the user passed
> name directly
>
> in the ->d_fsdata inplace of dmabuf object? Because we just need user passed
> name in the
>
> dmabuffs_dname(). With this we can avoid the need for extra refcount on
> dmabuf.
Odd formatting :(
> Posted patch-V2: https://lkml.org/lkml/2020/5/8/158
Please just post links to lore.kernel.org, we have no control over
lkml.org at all.
I'll go review that patch now...
greg k-h
WARNING: multiple messages have this Message-ID (diff)
From: Greg KH <gregkh@linuxfoundation.org>
To: Charan Teja Kalla <charante@codeaurora.org>
Cc: fengc@google.com, linux-kernel@vger.kernel.org,
ghackmann@google.com, linaro-mm-sig@lists.linaro.org,
vinmenon@codeaurora.org, dri-devel@lists.freedesktop.org,
linux-media@vger.kernel.org
Subject: Re: [PATCH] dma-buf: fix use-after-free in dmabuffs_dname
Date: Tue, 12 May 2020 10:45:34 +0200 [thread overview]
Message-ID: <20200512084534.GA3557007@kroah.com> (raw)
In-Reply-To: <3bc8dd81-f298-aea0-f218-2e2ef12ca603@codeaurora.org>
On Tue, May 12, 2020 at 10:43:18AM +0530, Charan Teja Kalla wrote:
> > Ok, but watch out, now you have 2 different reference counts for the
> > same structure. Keeping them coordinated is almost always an impossible
> > task so you need to only rely on one. If you can't use the file api,
> > just drop all of the reference counting logic in there and only use the
> > kref one.
>
> I feel that changing the refcount logic now to dma-buf objects involve
> changes in
>
> the core dma-buf framework. NO? Instead, how about passing the user passed
> name directly
>
> in the ->d_fsdata inplace of dmabuf object? Because we just need user passed
> name in the
>
> dmabuffs_dname(). With this we can avoid the need for extra refcount on
> dmabuf.
Odd formatting :(
> Posted patch-V2: https://lkml.org/lkml/2020/5/8/158
Please just post links to lore.kernel.org, we have no control over
lkml.org at all.
I'll go review that patch now...
greg k-h
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2020-05-12 8:45 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-28 7:54 [PATCH] dma-buf: fix use-after-free in dmabuffs_dname Charan Teja Reddy
2020-05-05 10:08 ` Greg KH
2020-05-06 8:30 ` Charan Teja Kalla
2020-05-06 8:30 ` Charan Teja Kalla
2020-05-06 9:00 ` Greg KH
2020-05-06 9:00 ` Greg KH
2020-05-12 5:13 ` Charan Teja Kalla
2020-05-12 5:13 ` Charan Teja Kalla
2020-05-12 8:45 ` Greg KH [this message]
2020-05-12 8:45 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200512084534.GA3557007@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=charante@codeaurora.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=fengc@google.com \
--cc=ghackmann@google.com \
--cc=linaro-mm-sig@lists.linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=sumit.semwal@linaro.org \
--cc=vinmenon@codeaurora.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.