linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Dan Williams <dan.j.williams@intel.com>
To: Sasha Levin <sashal@kernel.org>
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	stable <stable@vger.kernel.org>,
	Ben Widawsky <ben.widawsky@intel.com>,
	Jonathan Cameron <Jonathan.Cameron@huawei.com>,
	linux-cxl@vger.kernel.org
Subject: Re: [PATCH AUTOSEL 5.14 04/25] cxl/pci: Introduce cdevm_file_operations
Date: Tue, 14 Sep 2021 10:46:20 -0700	[thread overview]
Message-ID: <CAPcyv4iiF1b53zn+zVvCjJFs2JKX=HvHAVggae-wULVD8jBFBQ@mail.gmail.com> (raw)
In-Reply-To: <YUDVXV8egoZP05SF@sashalap>

On Tue, Sep 14, 2021 at 10:01 AM Sasha Levin <sashal@kernel.org> wrote:
>
> On Tue, Sep 14, 2021 at 08:42:04AM -0700, Dan Williams wrote:
> >On Mon, Sep 13, 2021 at 3:33 PM Sasha Levin <sashal@kernel.org> wrote:
> >>
> >> From: Dan Williams <dan.j.williams@intel.com>
> >>
> >> [ Upstream commit 9cc238c7a526dba9ee8c210fa2828886fc65db66 ]
> >>
> >> In preparation for moving cxl_memdev allocation to the core, introduce
> >> cdevm_file_operations to coordinate file operations shutdown relative to
> >> driver data release.
> >>
> >> The motivation for moving cxl_memdev allocation to the core (beyond
> >> better file organization of sysfs attributes in core/ and drivers in
> >> cxl/), is that device lifetime is longer than module lifetime. The cxl_pci
> >> module should be free to come and go without needing to coordinate with
> >> devices that need the text associated with cxl_memdev_release() to stay
> >> resident. The move will fix a use after free bug when looping driver
> >> load / unload with CONFIG_DEBUG_KOBJECT_RELEASE=y.
> >>
> >> Another motivation for passing in file_operations to the core cxl_memdev
> >> creation flow is to allow for alternate drivers, like unit test code, to
> >> define their own ioctl backends.
> >
> >Hi Sasha,
> >
> >Please drop this. It's not a fix, it's just a reorganization for
> >easing the addition of new features and capabilities.
>
> I'll drop it, but just to satisfy my curiousity: the description says it
> fixes a use-after-free bug in the existing code, is it not the case?

It does fix a problem if the final put_device() happens after the
module text has been unloaded. However, I am only aware of the
artificial trigger for that (CONFIG_DEBUG_KOBJECT_RELEASE=y). I.e. if
CONFIG_DEBUG_KOBJECT_RELEASE=n I am not aware of any agent that will
hold a device reference besides the driver itself. That was the
rationale for not tagging this for -stable.

  reply	other threads:[~2021-09-14 17:46 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-13 22:33 [PATCH AUTOSEL 5.14 01/25] dmaengine: idxd: depends on !UML Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 02/25] dmaengine: sprd: Add missing MODULE_DEVICE_TABLE Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 03/25] cxl: Move cxl_core to new directory Sasha Levin
2021-09-14  8:56   ` Jonathan Cameron
2021-09-14  8:57     ` Jonathan Cameron
2021-09-14 15:05       ` Ben Widawsky
2021-09-14 15:40         ` Dan Williams
2021-09-14 17:00         ` Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 04/25] cxl/pci: Introduce cdevm_file_operations Sasha Levin
2021-09-14 15:42   ` Dan Williams
2021-09-14 17:01     ` Sasha Levin
2021-09-14 17:46       ` Dan Williams [this message]
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 05/25] gfs2: Switch to may_setattr in gfs2_setattr Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 06/25] dmaengine: ioat: depends on !UML Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 07/25] dmaengine: xilinx_dma: Set DMA mask for coherent APIs Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 08/25] s390: add kmemleak annotation in stack_alloc() Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 09/25] ASoC: audio-graph: respawn Platform Support Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 10/25] ACPI: PM: s2idle: Run both AMD and Microsoft methods if both are supported Sasha Levin
2021-09-21 14:57   ` Limonciello, Mario
2021-09-24 11:40     ` Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 11/25] ceph: fix memory leak on decode error in ceph_handle_caps Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 12/25] ceph: request Fw caps before updating the mtime in ceph_write_iter Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 13/25] ceph: remove the capsnaps when removing caps Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 14/25] ceph: lockdep annotations for try_nonblocking_invalidate Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 15/25] s390/unwind: use current_frame_address() to unwind current task Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 16/25] btrfs: update the bdev time directly when closing Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 17/25] btrfs: delay blkdev_put until after the device remove Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 18/25] btrfs: fix lockdep warning while mounting sprout fs Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 19/25] connector: send event on write to /proc/[pid]/comm Sasha Levin
2021-09-15 13:45   ` Eric W. Biederman
2021-09-16  0:36     ` Sasha Levin
2021-09-16 15:49       ` Eric W. Biederman
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 20/25] nilfs2: fix memory leak in nilfs_sysfs_create_device_group Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 21/25] nilfs2: fix NULL pointer in nilfs_##name##_attr_release Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 22/25] nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 23/25] nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 24/25] nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group Sasha Levin
2021-09-13 22:33 ` [PATCH AUTOSEL 5.14 25/25] nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAPcyv4iiF1b53zn+zVvCjJFs2JKX=HvHAVggae-wULVD8jBFBQ@mail.gmail.com' \
    --to=dan.j.williams@intel.com \
    --cc=Jonathan.Cameron@huawei.com \
    --cc=ben.widawsky@intel.com \
    --cc=linux-cxl@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).