* [PATCH] acpi: Fix use-after-free in acpi_ipmi.c
@ 2020-11-24 12:51 Youling Tang
2020-11-25 15:53 ` Rafael J. Wysocki
0 siblings, 1 reply; 3+ messages in thread
From: Youling Tang @ 2020-11-24 12:51 UTC (permalink / raw)
To: Rafael J. Wysocki, Len Brown; +Cc: linux-acpi, linux-kernel
kfree() has been called inside put_device so anther kfree would cause a
use-after-free bug.
Signed-off-by: Youling Tang <tangyouling@loongson.cn>
---
drivers/acpi/acpi_ipmi.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
index 9d6c0fc..72902b6 100644
--- a/drivers/acpi/acpi_ipmi.c
+++ b/drivers/acpi/acpi_ipmi.c
@@ -130,7 +130,6 @@ ipmi_dev_alloc(int iface, struct device *dev, acpi_handle handle)
ipmi_device, &user);
if (err) {
put_device(dev);
- kfree(ipmi_device);
return NULL;
}
ipmi_device->user_interface = user;
@@ -142,7 +141,6 @@ static void ipmi_dev_release(struct acpi_ipmi_device *ipmi_device)
{
ipmi_destroy_user(ipmi_device->user_interface);
put_device(ipmi_device->dev);
- kfree(ipmi_device);
}
static void ipmi_dev_release_kref(struct kref *kref)
--
2.1.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] acpi: Fix use-after-free in acpi_ipmi.c
2020-11-24 12:51 [PATCH] acpi: Fix use-after-free in acpi_ipmi.c Youling Tang
@ 2020-11-25 15:53 ` Rafael J. Wysocki
2020-11-26 1:16 ` Youling Tang
0 siblings, 1 reply; 3+ messages in thread
From: Rafael J. Wysocki @ 2020-11-25 15:53 UTC (permalink / raw)
To: Youling Tang
Cc: Rafael J. Wysocki, Len Brown, ACPI Devel Maling List,
Linux Kernel Mailing List
On Tue, Nov 24, 2020 at 1:51 PM Youling Tang <tangyouling@loongson.cn> wrote:
>
> kfree() has been called inside put_device so anther kfree would cause a
> use-after-free bug.
>
> Signed-off-by: Youling Tang <tangyouling@loongson.cn>
> ---
> drivers/acpi/acpi_ipmi.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
> index 9d6c0fc..72902b6 100644
> --- a/drivers/acpi/acpi_ipmi.c
> +++ b/drivers/acpi/acpi_ipmi.c
> @@ -130,7 +130,6 @@ ipmi_dev_alloc(int iface, struct device *dev, acpi_handle handle)
> ipmi_device, &user);
> if (err) {
> put_device(dev);
> - kfree(ipmi_device);
dev doesn't point to the same object in memory as ipmi_device, though,
if I'm not mistaken.
Please double check that and resend the patch if you are sure that it
is correct.
> return NULL;
> }
> ipmi_device->user_interface = user;
> @@ -142,7 +141,6 @@ static void ipmi_dev_release(struct acpi_ipmi_device *ipmi_device)
> {
> ipmi_destroy_user(ipmi_device->user_interface);
> put_device(ipmi_device->dev);
> - kfree(ipmi_device);
> }
>
> static void ipmi_dev_release_kref(struct kref *kref)
> --
> 2.1.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] acpi: Fix use-after-free in acpi_ipmi.c
2020-11-25 15:53 ` Rafael J. Wysocki
@ 2020-11-26 1:16 ` Youling Tang
0 siblings, 0 replies; 3+ messages in thread
From: Youling Tang @ 2020-11-26 1:16 UTC (permalink / raw)
To: Rafael J. Wysocki
Cc: Rafael J. Wysocki, Len Brown, ACPI Devel Maling List,
Linux Kernel Mailing List
Hi,
On 11/25/2020 11:53 PM, Rafael J. Wysocki wrote:
> On Tue, Nov 24, 2020 at 1:51 PM Youling Tang <tangyouling@loongson.cn> wrote:
>> kfree() has been called inside put_device so anther kfree would cause a
>> use-after-free bug.
>>
>> Signed-off-by: Youling Tang <tangyouling@loongson.cn>
>> ---
>> drivers/acpi/acpi_ipmi.c | 2 --
>> 1 file changed, 2 deletions(-)
>>
>> diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
>> index 9d6c0fc..72902b6 100644
>> --- a/drivers/acpi/acpi_ipmi.c
>> +++ b/drivers/acpi/acpi_ipmi.c
>> @@ -130,7 +130,6 @@ ipmi_dev_alloc(int iface, struct device *dev, acpi_handle handle)
>> ipmi_device, &user);
>> if (err) {
>> put_device(dev);
>> - kfree(ipmi_device);
> dev doesn't point to the same object in memory as ipmi_device, though,
> if I'm not mistaken.
>
> Please double check that and resend the patch if you are sure that it
> is correct.
You're right, dev really doesn't point to the same memory object
as ipmi_device. I'll send v2 later.
Thanks,
Youling.
>> return NULL;
>> }
>> ipmi_device->user_interface = user;
>> @@ -142,7 +141,6 @@ static void ipmi_dev_release(struct acpi_ipmi_device *ipmi_device)
>> {
>> ipmi_destroy_user(ipmi_device->user_interface);
>> put_device(ipmi_device->dev);
>> - kfree(ipmi_device);
>> }
>>
>> static void ipmi_dev_release_kref(struct kref *kref)
>> --
>> 2.1.0
>>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-11-26 1:16 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-24 12:51 [PATCH] acpi: Fix use-after-free in acpi_ipmi.c Youling Tang
2020-11-25 15:53 ` Rafael J. Wysocki
2020-11-26 1:16 ` Youling Tang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).