Re: [PATCH net] 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
From: kernel test robot
Date: Mon Mar 13 2023 - 03:22:13 EST
Hi Zheng,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on net/master]
url: https://github.com/intel-lab-lkp/linux/commits/Zheng-Wang/9p-xen-Fix-use-after-free-bug-in-xen_9pfs_front_remove-due-to-race-condition/20230313-121534
patch link: https://lore.kernel.org/r/20230313041303.3158458-1-zyytlz.wz%40163.com
patch subject: [PATCH net] 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
config: arm-randconfig-r046-20230313 (https://download.01.org/0day-ci/archive/20230313/202303131508.drILo2xA-lkp@xxxxxxxxx/config)
compiler: arm-linux-gnueabi-gcc (GCC) 12.1.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/bf2159b54bb14c42221106b8681c471d005e7345
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Zheng-Wang/9p-xen-Fix-use-after-free-bug-in-xen_9pfs_front_remove-due-to-race-condition/20230313-121534
git checkout bf2159b54bb14c42221106b8681c471d005e7345
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=arm olddefconfig
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=arm SHELL=/bin/bash net/9p/
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Link: https://lore.kernel.org/oe-kbuild-all/202303131508.drILo2xA-lkp@xxxxxxxxx/
All errors (new ones prefixed by >>):
net/9p/trans_xen.c: In function 'xen_9pfs_front_free':
>> net/9p/trans_xen.c:284:24: error: incompatible types when assigning to type 'struct xen_9pfs_dataring *' from type 'struct xen_9pfs_dataring'
284 | ring = priv->rings[i];
| ^~~~
vim +284 net/9p/trans_xen.c
273
274 static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
275 {
276 int i, j;
277 struct xen_9pfs_dataring *ring = NULL;
278
279 write_lock(&xen_9pfs_lock);
280 list_del(&priv->list);
281 write_unlock(&xen_9pfs_lock);
282
283 for (i = 0; i < priv->num_rings; i++) {
> 284 ring = priv->rings[i];
285 if (!priv->rings[i].intf)
286 break;
287 if (priv->rings[i].irq > 0)
288 unbind_from_irqhandler(priv->rings[i].irq, priv->dev);
289
290 cancel_work_sync(&ring->work);
291
292 if (priv->rings[i].data.in) {
293 for (j = 0;
294 j < (1 << priv->rings[i].intf->ring_order);
295 j++) {
296 grant_ref_t ref;
297
298 ref = priv->rings[i].intf->ref[j];
299 gnttab_end_foreign_access(ref, NULL);
300 }
301 free_pages_exact(priv->rings[i].data.in,
302 1UL << (priv->rings[i].intf->ring_order +
303 XEN_PAGE_SHIFT));
304 }
305 gnttab_end_foreign_access(priv->rings[i].ref, NULL);
306 free_page((unsigned long)priv->rings[i].intf);
307 }
308 kfree(priv->rings);
309 kfree(priv->tag);
310 kfree(priv);
311 }
312
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests