From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f44.google.com (mail-ed1-f44.google.com [209.85.208.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E44D43FDBE2 for ; Wed, 5 Aug 2026 09:35:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785922546; cv=none; b=FN/1/kDc/aTht9TgrZbayowLfmut7iADAN4d2pYYpsn6Xkh3sCOPBffMIHTDz4ccdjHHgFPK4kEBn5kKPVc/COxbkmzNJCKbDNaFpL+2BBa1el7OQ5+1K2dnhr4bbvNaw7+MdmRJaodNrRUDFH4FETBZKGhX9kgvOIw279S8zuE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785922546; c=relaxed/simple; bh=wbEz3/GgiyV/LRwtjv5NF5lwFtBKS/paYLiWip9AfRs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=FA6iUkcP8ypfiMovSlq6ny4XwLXDBWMA4U85K/t3U8EaqYKc7Y9tRYKQ5PtC0V0z0/OChMI7nVaP9wba1PCe9oOOlYaQhseuLZGdXFsFV2LtQCLq90ibVAkBn9dXUJazrFliRXATIviqrQmnCN4jS86djdCtIS3POgfxkZw+GN8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=joO7kjEh; arc=none smtp.client-ip=209.85.208.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="joO7kjEh" Received: by mail-ed1-f44.google.com with SMTP id 4fb4d7f45d1cf-6a063d211ebso989908a12.3 for ; Wed, 05 Aug 2026 02:35:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785922543; x=1786527343; darn=vger.kernel.org; h=references:in-reply-to:message-id:date:subject:cc:to:from:from:to :cc:subject:date:message-id:reply-to:content-type; bh=phuXBEgi+sUfdKAX70E2L8fJ1PdsrWN+n3/h1ZeXFss=; b=joO7kjEh56ucMqHIfFXpTeQcWRGeVbVW3XNHKRrrkGam0PGkL5s38U8y4hFMHniR1Q LmovuhHcICBJ8X0rI5kbvrQaqZZBKOwvhrIrAAybeiGrK+JnD3+glbj41b+WrsK79fvU TQJqJLyEnOKjIwMiZQXTeCFjNfzJXGo5BEwIZTd6shvqi5Y7hDHeUF9MhwW3NOOSOrle t4Irlj7QOx6Sdvt1Ba2/QuY3zqj9jN2/hWLt9EfWmGKZphjfkbl9dZWn4Q3uvyNuSp8I KwW42tjthEBPP7t+5zir9O55xpkBegR/xjiLFxkpX7HftLfunXQO6oBDF28tkLpOGvyx 0kpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785922543; x=1786527343; h=references:in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=phuXBEgi+sUfdKAX70E2L8fJ1PdsrWN+n3/h1ZeXFss=; b=H9B+ZzHjeZT7Du6P4WuSg4Nc+jhnJhFeKDzjDul703I+6s1QW/bE6Km+dlwXoYcaPc cYcXp9WJH5S2Ao0dLoTVvg+wWZkRUExSOi3kZS3EP6QEMyYsluM+LITj2132TuNhCGYW ZPfUslmbwmGMwG7yRad4jfi95tG7tZT/RZ4yPizmB3IK3KeaX3CeaE9bRTcTG/1HB7MG KgdGcboNl3qky8VU8e/TnRcDxw4I8yh+ZR+yEeb4LO4Q5/IEHKY9Pg3VP8jfcak1LFzd JbN+KxxZ1E8auw1MMWMXkZG0estDVJ/U2Yqv6AjoBDkSd2yk/6oq6jfqAULqucu0yLZP YrQg== X-Forwarded-Encrypted: i=1; AHgh+RqunfUpp3ldIyGOB0agm30DXn0Jh4JpBKYDHhcUlck8CcP7Y89DtB6B7WJ+ShCELbRy+4dF3VOF0GTAVDM=@vger.kernel.org X-Gm-Message-State: AOJu0YyxfslWCsX1gHmEPW9aNianlCWBR0kuIb9P24d66iYnAJDzingY GJrsGobZraVUuD/q96M43SLd2qmwbdXRYZfp1r2bP/be1F5l6dpuXkUhv4wGx+tobJo= X-Gm-Gg: AR+sD10yqXNTgCtSrQfPR3xUzGrsq65vHIBX10ugTxzyPnUy0fqPpGs15z7g9Ty8QLt 6jwfxIE5NYOvRPlrBn26q4rYgwGaDh/uAK2BJvAHrDMZ0rzxcprnoHSggHK+wFl78uL9HWOK2vO ZEqeiX4ahw/nQ9Pm6mFsNmXQ9NgTp2VFLzZoXu6rHHeUdSE+zyl+RpbV4e1AN/h4pixXuiJBmoq +pWV06D83YO9DO953vDFZb4BAvoYb8JXLLsdfwO98pIQWOezSEpFVCzN8E3n5rvvwpB5KOE4wWX 1IBGURrK4i4qBK+iIlsWAOdSVsvASWC4UCYQ4HHFnm/Wx26xvOuQNx1M0p3J15MY1+JGYJuTWwm oC4u1dO7TaPj3Crnw60Nf0yx5R3/s21k37OwU7ee9ToQm6pWw9VCNICmPJWVNxVyI2TqwrXzX0a scVFMCQh/IWxVCd012kaDuzXzSqj9Bf2Ebwae4HkA0HCjqREboBbjKVsYsjYtFofzu49BS6DG3Y cj+RFfngEtpV9rd X-Received: by 2002:a05:6402:1cd0:b0:6a0:a644:355e with SMTP id 4fb4d7f45d1cf-6a14f0a1306mr2873890a12.2.1785922543057; Wed, 05 Aug 2026 02:35:43 -0700 (PDT) Received: from localhost (c-85-228-45-68.bbcust.telenor.se. [85.228.45.68]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6a17760bff2sm934561a12.20.2026.08.05.02.35.41 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Wed, 05 Aug 2026 02:35:41 -0700 (PDT) From: Eli Billauer To: gregkh@linuxfoundation.org Cc: arnd@arndb.de, linux-kernel@vger.kernel.org, corbet@lwn.net, Eli Billauer Subject: [PATCH v4 2/7] char: xillybus: Remove duplicate error path code Date: Wed, 5 Aug 2026 11:34:31 +0200 Message-Id: <20260805093436.59740-3-eli.billauer@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20260805093436.59740-1-eli.billauer@gmail.com> References: <20260805093436.59740-1-eli.billauer@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Remove dedicated code for the error path, which is both redundant and incorrect: It calls kref_put() before mutex_unlock(&chan->lock). As kref_put() may result in releasing the memory containing the mutex, this could lead to UAF. Assisted-by: Deepseek:v4-pro Kimi:K2.6 ChatGPT:GPT-5.5 Claude:Sonnet-4.6 Assisted-by: Sashiko-0.2.5:gemini-3.1-pro-preview Signed-off-by: Eli Billauer --- Notes: Changelog: ========= Changes v3->v4: -- Correct the commit description to indicate that the removed duplicate code wasn't only redundant, but could also lead to a UAF, as pointed out by Sashiko, and an attribution is hence added too. Changes v2->v3: -- Add Assisted-by tag to description No change on v1->v2. drivers/char/xillybus/xillyusb.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/char/xillybus/xillyusb.c b/drivers/char/xillybus/xillyusb.c index 560c3568fc96..ee819e2e3f82 100644 --- a/drivers/char/xillybus/xillyusb.c +++ b/drivers/char/xillybus/xillyusb.c @@ -1424,16 +1424,12 @@ static int xillyusb_open(struct inode *inode, struct file *filp) if (filp->f_mode & FMODE_WRITE) chan->open_for_write = 0; +unmutex_fail: mutex_unlock(&chan->lock); kref_put(&xdev->kref, cleanup_dev); return rc; - -unmutex_fail: - kref_put(&xdev->kref, cleanup_dev); - mutex_unlock(&chan->lock); - return rc; } static ssize_t xillyusb_read(struct file *filp, char __user *userbuf, -- 2.34.1