All of lore.kernel.org
 help / color / mirror / Atom feed
From: patchwork-bot+netdevbpf@kernel.org
To: Jialiang Wang <wangjialiang0806@163.com>
Cc: simon.horman@corigine.com, kuba@kernel.org, davem@davemloft.net,
	edumazet@google.com, pabeni@redhat.com, niejianglei2021@163.com,
	oss-drivers@corigine.com, netdev@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH v3] nfp: fix use-after-free in area_cache_get()
Date: Thu, 11 Aug 2022 16:10:15 +0000	[thread overview]
Message-ID: <166023421525.9507.12428200165169561355.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <20220810073057.4032-1-wangjialiang0806@163.com>

Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 10 Aug 2022 15:30:57 +0800 you wrote:
> area_cache_get() is used to distribute cache->area and set cache->id,
>  and if cache->id is not 0 and cache->area->kref refcount is 0, it will
>  release the cache->area by nfp_cpp_area_release(). area_cache_get()
>  set cache->id before cpp->op->area_init() and nfp_cpp_area_acquire().
> 
> But if area_init() or nfp_cpp_area_acquire() fails, the cache->id is
>  is already set but the refcount is not increased as expected. At this
>  time, calling the nfp_cpp_area_release() will cause use-after-free.
> 
> [...]

Here is the summary with links:
  - [v3] nfp: fix use-after-free in area_cache_get()
    https://git.kernel.org/netdev/net/c/02e1a114fdb7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



  parent reply	other threads:[~2022-08-11 16:33 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-10  7:30 [PATCH v3] nfp: fix use-after-free in area_cache_get() Jialiang Wang
2022-08-11  4:10 ` Yinjun Zhang
2022-08-11  8:34   ` Simon Horman
2022-08-11 16:10 ` patchwork-bot+netdevbpf [this message]
2022-12-07 12:21 ` Lee Jones
2022-12-08 14:09   ` Simon Horman
2022-12-14 10:20     ` Lee Jones
2022-12-15  9:25     ` Lee Jones
2022-12-15  9:45       ` Greg KH
2022-12-15  9:51         ` Lee Jones

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=166023421525.9507.12428200165169561355.git-patchwork-notify@kernel.org \
    --to=patchwork-bot+netdevbpf@kernel.org \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=niejianglei2021@163.com \
    --cc=oss-drivers@corigine.com \
    --cc=pabeni@redhat.com \
    --cc=simon.horman@corigine.com \
    --cc=wangjialiang0806@163.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.