From: Mika Westerberg <mika.westerberg@linux.intel.com>
To: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Cc: andreas.noever@gmail.com, michael.jamet@intel.com,
YehezkelShB@gmail.com, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] thunderbolt: Fix a double put in tb_cfg_read_raw
Date: Tue, 23 Mar 2021 16:06:47 +0200 [thread overview]
Message-ID: <20210323140647.GV2542@lahna.fi.intel.com> (raw)
In-Reply-To: <20210323031512.12234-1-lyl2019@mail.ustc.edu.cn>
Hi,
On Mon, Mar 22, 2021 at 08:15:12PM -0700, Lv Yunlong wrote:
> In tb_cfg_read_raw, req is allocated by tb_cfg_request_alloc()
> with an initial reference. Before calling tb_cfg_request_sync(),
> there is no refcount inc operation. tb_cfg_request_sync()
> calls tb_cfg_request(..,req,..) and if the callee failed,
> the initial reference of req is dropped and req is freed.
>
> Later in tb_cfg_read_raw before the err check,
> tb_cfg_request_put(req) is called again. It may cause error
> in race.
Hmm, tb_cfg_request() does tb_cfg_request_get() too and in case of error
it does tb_cfg_request_put(). So the refcount should be fine. What am I
missing?
>
> My patch puts tb_cfg_request_put(req) after the err check
> finished to avoid unexpected result.
>
> Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
> ---
> drivers/thunderbolt/ctl.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/thunderbolt/ctl.c b/drivers/thunderbolt/ctl.c
> index f1aeaff9f368..bb60269c89ab 100644
> --- a/drivers/thunderbolt/ctl.c
> +++ b/drivers/thunderbolt/ctl.c
> @@ -890,11 +890,11 @@ struct tb_cfg_result tb_cfg_read_raw(struct tb_ctl *ctl, void *buffer,
>
> res = tb_cfg_request_sync(ctl, req, timeout_msec);
>
> - tb_cfg_request_put(req);
> -
> if (res.err != -ETIMEDOUT)
> break;
>
> + tb_cfg_request_put(req);
> +
> /* Wait a bit (arbitrary time) until we send a retry */
> usleep_range(10, 100);
> }
> --
> 2.25.1
>
next prev parent reply other threads:[~2021-03-23 14:08 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-23 3:15 [PATCH] thunderbolt: Fix a double put in tb_cfg_read_raw Lv Yunlong
2021-03-23 14:06 ` Mika Westerberg [this message]
2021-03-23 14:30 ` lyl2019
2021-03-23 14:44 ` Mika Westerberg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210323140647.GV2542@lahna.fi.intel.com \
--to=mika.westerberg@linux.intel.com \
--cc=YehezkelShB@gmail.com \
--cc=andreas.noever@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=lyl2019@mail.ustc.edu.cn \
--cc=michael.jamet@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).