All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Pavel Skripkin <paskripkin@gmail.com>
Cc: Yanfei Xu <yanfei.xu@windriver.com>,
	Bartosz Golaszewski <bgolaszewski@baylibre.com>,
	andrew@lunn.ch, hkallweit1@gmail.com, linux@armlinux.org.uk,
	davem@davemloft.net, kuba@kernel.org, p.zabel@pengutronix.de,
	syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com,
	linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
	Dongliang Mu <mudongliangabcd@gmail.com>
Subject: Re: [PATCH] net: mdiobus: Fix memory leak in __mdiobus_register
Date: Tue, 28 Sep 2021 15:23:48 +0300	[thread overview]
Message-ID: <20210928122348.GO2083@kadam> (raw)
In-Reply-To: <c86fecd6-6412-fec8-1dce-81e99c059e38@gmail.com>

On Tue, Sep 28, 2021 at 02:45:39PM +0300, Pavel Skripkin wrote:
> On 9/28/21 14:30, Dan Carpenter wrote:
> > On Tue, Sep 28, 2021 at 02:09:06PM +0300, Pavel Skripkin wrote:
> >
> > Huh...  You're right that the log should say "failed to register".  But
> > I don't think that's the correct syzbot link for your patch either
> > because I don't think anyone calls mdiobus_free() if
> > __devm_mdiobus_register() fails.  I have looked at these callers.  It
> > would be a bug as well.
> > 
> 
> mdiobus_free() is called in case of ->probe() failure, because devres clean
> up function for bus is devm_mdiobus_free(). It simply calls mdiobus_free().
> 
> 
> So, i imagine following calltrace:
> 
> ax88772_bind
>   ax88772_init_mdio
>     devm_mdiobus_alloc() <- bus registered as devres
>     devm_mdiobus_register() <- fail (->probe failure)
> 
> ...
> 
> devres_release_all
>   mdiobus_free()

Argh... Crap.  You're right.  There is just one bug.  No need to
change __devm_mdiobus_register() and trying to do that would lead to a
UAF.

Your patch is the correct fix but with the modifications we discussed.

regards,
dan carpenter


  reply	other threads:[~2021-09-28 12:24 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-26  4:53 [PATCH] net: mdiobus: Fix memory leak in __mdiobus_register Yanfei Xu
2021-09-26 15:34 ` Andrew Lunn
2021-09-27 12:30 ` patchwork-bot+netdevbpf
2021-09-28  8:55 ` Dan Carpenter
2021-09-28  9:26   ` Dan Carpenter
2021-09-28  9:45     ` Pavel Skripkin
2021-09-28 10:39       ` Dan Carpenter
2021-09-28 10:46         ` Pavel Skripkin
2021-09-28 10:55           ` Dan Carpenter
2021-09-28 11:04             ` Pavel Skripkin
2021-09-28 10:59           ` Dan Carpenter
2021-09-28 11:06             ` Pavel Skripkin
2021-09-28 11:09               ` Pavel Skripkin
2021-09-28 11:30                 ` Dan Carpenter
2021-09-28 11:45                   ` Pavel Skripkin
2021-09-28 12:23                     ` Dan Carpenter [this message]
2021-09-28 12:58                   ` Russell King (Oracle)
2021-09-28 13:52                     ` Dan Carpenter
2021-09-28 15:41                       ` Russell King (Oracle)
2021-09-28 15:48                         ` Dongliang Mu
2021-09-29  2:05                           ` Xu, Yanfei
2021-09-28 13:11 ` Russell King (Oracle)
2021-09-29 21:31 ` Denis Efremov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210928122348.GO2083@kadam \
    --to=dan.carpenter@oracle.com \
    --cc=andrew@lunn.ch \
    --cc=bgolaszewski@baylibre.com \
    --cc=davem@davemloft.net \
    --cc=hkallweit1@gmail.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@armlinux.org.uk \
    --cc=mudongliangabcd@gmail.com \
    --cc=netdev@vger.kernel.org \
    --cc=p.zabel@pengutronix.de \
    --cc=paskripkin@gmail.com \
    --cc=syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com \
    --cc=yanfei.xu@windriver.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.