Re: [Linaro-mm-sig] Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-12-06 Thread Christian König
Am 06.12.22 um 13:55 schrieb Charan Teja Kalla: Thanks Christian/TJ for all your inputs!! On 11/24/2022 6:25 PM, Christian König wrote: I was already wondering why the order is this way. Why is dma_buf_stats_setup() needing the file in the first place? dmabuf->file will be used in dma_buf_sta

Re: [Linaro-mm-sig] Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-12-06 Thread Charan Teja Kalla
Thanks Christian/TJ for all your inputs!! On 11/24/2022 6:25 PM, Christian König wrote: >>> I was already wondering why the order is this way. >>> >>> Why is dma_buf_stats_setup() needing the file in the first place? >> >> dmabuf->file will be used in dma_buf_stats_setup(), the >> dma_buf_stats_s

Re: [Linaro-mm-sig] Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-24 Thread Christian König
Am 24.11.22 um 13:49 schrieb cuigaosheng: I was already wondering why the order is this way. Why is dma_buf_stats_setup() needing the file in the first place? dmabuf->file will be used in dma_buf_stats_setup(), the dma_buf_stats_setup() as follows: 171 int dma_buf_stats_setup(struct dma

Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-24 Thread cuigaosheng
I was already wondering why the order is this way. Why is dma_buf_stats_setup() needing the file in the first place? dmabuf->file will be used in dma_buf_stats_setup(), the dma_buf_stats_setup() as follows: 171 int dma_buf_stats_setup(struct dma_buf *dmabuf) 172 { 173 struct dma_bu

Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-24 Thread Christian König
Am 24.11.22 um 13:05 schrieb cuigaosheng: Some tips:     Before we call the dma_buf_stats_setup(), we have to finish creating the file, otherwise dma_buf_stats_setup() will return -EINVAL, maybe we need to think about this when making a new patch. I was already wondering why the order is

Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-24 Thread cuigaosheng
Some tips: Before we call the dma_buf_stats_setup(), we have to finish creating the file, otherwise dma_buf_stats_setup() will return -EINVAL, maybe we need to think about this when making a new patch. Hope these tips are useful, thanks! On 2022/11/24 13:56, Charan Teja Kalla wrote: Thank

Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-24 Thread cuigaosheng
Thanks T.J and Christian, thanks everyone for taking time to review this patch. Charan, actually I don't have a good patch to to fix it, if you can submit a new patch to solve it, please feel free to do it. By the way, I'd appreciate it if you could send to me the new patch when you submit it.

Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-23 Thread Charan Teja Kalla
Thanks T.J and Christian for the inputs. On 11/19/2022 7:00 PM, Christian König wrote: >> >>     Yes, exactly that's the idea. >> >>     The only alternatives I can see would be to either move allocating >>     the >>     file and so completing the dma_buf initialization last again or just >>    

Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-19 Thread Christian König
Am 18.11.22 um 18:05 schrieb T.J. Mercier: On Fri, Nov 18, 2022 at 12:27 AM Christian König wrote: Am 18.11.22 um 03:36 schrieb T.J. Mercier: > On Thu, Nov 17, 2022 at 2:16 AM Christian König > wrote: >> Am 17.11.22 um 08:48 schrieb Charan Teja Kalla: >>> Sometime back

Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-18 Thread T.J. Mercier
On Fri, Nov 18, 2022 at 12:27 AM Christian König wrote: > Am 18.11.22 um 03:36 schrieb T.J. Mercier: > > On Thu, Nov 17, 2022 at 2:16 AM Christian König > > wrote: > >> Am 17.11.22 um 08:48 schrieb Charan Teja Kalla: > >>> Sometime back Dan also reported the same issue[1] where I do mentioned >

Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-18 Thread Christian König
Am 18.11.22 um 03:36 schrieb T.J. Mercier: On Thu, Nov 17, 2022 at 2:16 AM Christian König wrote: Am 17.11.22 um 08:48 schrieb Charan Teja Kalla: Sometime back Dan also reported the same issue[1] where I do mentioned that fput()-->dma_buf_file_release() will remove it from the list. But it se

Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-17 Thread T.J. Mercier
On Thu, Nov 17, 2022 at 2:16 AM Christian König wrote: > > Am 17.11.22 um 08:48 schrieb Charan Teja Kalla: > > Sometime back Dan also reported the same issue[1] where I do mentioned > > that fput()-->dma_buf_file_release() will remove it from the list. > > > > But it seems that I failed to notice

Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-17 Thread Christian König
Am 17.11.22 um 08:48 schrieb Charan Teja Kalla: Sometime back Dan also reported the same issue[1] where I do mentioned that fput()-->dma_buf_file_release() will remove it from the list. But it seems that I failed to notice fput() here calls the dma_buf_file_release() asynchronously i.e. dmabuf t

Re: [PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-16 Thread Charan Teja Kalla
Sometime back Dan also reported the same issue[1] where I do mentioned that fput()-->dma_buf_file_release() will remove it from the list. But it seems that I failed to notice fput() here calls the dma_buf_file_release() asynchronously i.e. dmabuf that is accessed in the close path is already freed

[PATCH] dma-buf: Fix possible UAF in dma_buf_export

2022-11-16 Thread Gaosheng Cui
Smatch report warning as follows: drivers/dma-buf/dma-buf.c:681 dma_buf_export() warn: '&dmabuf->list_node' not removed from list If dma_buf_stats_setup() fails in dma_buf_export(), goto err_sysfs and dmabuf will be freed, but dmabuf->list_node will not be removed from db_list.head, then list t