Re: [PATCH] driver core: Fix use-after-free and double free on glue directory

[Gaurav Kohli]

Thanks for the comment, will check the patch and update.

Regards
Gaurav

On 5/10/2019 4:52 AM, Benjamin Herrenschmidt wrote:
> On Thu, 2019-05-09 at 20:08 +0530, Gaurav Kohli wrote:
> > Hi ,
> >
> > Last patch will serialize the addition of child to parent directory,
> > won't it affect performance.
>
> I doubt this is a significant issue, and there's already a global lock
> taken once or twice in that path, the fix is purely to make sure that
> the some locked section is used both for the lookup and the addition as
> the bug comes from the window in between those two operations allowing
> the object to be removed after it was "found".
>
> Cheers,
> Ben.
>   
> > Regards
> > Gaurav
> >
> > On 5/4/2019 9:04 PM, Greg KH wrote:
> > > On Sat, May 04, 2019 at 10:47:07PM +0800, Muchun Song wrote:
> > > > Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx> ä2019å5æ2æåå
> > > > äå2:25åéï
> > > >
> > > > > > > The basic idea yes, the whole bool *locked is horrid
> > > > > > > though.
> > > > > > > Wouldn't it
> > > > > > > work to have a get_device_parent_locked that always returns
> > > > > > > with
> > > > > > > the mutex held,
> > > > > > > or just move the mutex to the caller or something simpler
> > > > > > > like this
> > > > > > > ?
> > > > > >
> > > > > > Greg and Rafael, do you have any suggestions for this? Or you
> > > > > > also
> > > > > > agree with Ben?
> > > > >
> > > > > Ping guys ? This is worth fixing...
> > > >
> > > > I also agree with you. But Greg and Rafael seem to be high
> > > > latency right now.
> > >
> > > It's in my list of patches to get to, sorry, hopefully will dig out
> > > of
> > > that next week with the buffer that the merge window provides me.
> > >
> > > thanks,
> > >
> > > greg k-h

--
Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center,
Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project.