From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f52.google.com (mail-ed1-f52.google.com [209.85.208.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 66EA342FCB3 for ; Wed, 5 Aug 2026 11:13:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785928440; cv=none; b=l3Ipmkr+qAI3CRxYF72Dzm2qPc85rzXld9EBdXLxW2DCw4RQNrQoCIEn21dCo+oui+wFbJePwuxjfYsXb+epBGVxCo5vcNYM+IjCL3PjqlmHcW5Y2MCwWNPOfBAgEceAc/8jcSy5qWpUmVsj0Uqfih98M4xxr6P+xybRvvzSeow= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785928440; c=relaxed/simple; bh=3RnwFDiFqQ/knUwztEMZjX3bELXiUAjO0dNFjnlXwNU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=pTUIqjyUSZDQPqhNB2SZSnof+HM4LZTjIrF48ihi45z5G/FnbrlmneNNcLTNNSac+YVb3CJFSU9fanSNxSxXaOWs1oHqH1siKOui14yp0VThze5AxhJu2tMynuKfXdO9gMhmavPR8q/QX6Sb+LN5ZEdnoebno3nfn7KGuig7Tgs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Ceps4/Y/; arc=none smtp.client-ip=209.85.208.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Ceps4/Y/" Received: by mail-ed1-f52.google.com with SMTP id 4fb4d7f45d1cf-6a0a4aa99bdso1242000a12.1 for ; Wed, 05 Aug 2026 04:13:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785928437; x=1786533237; darn=vger.kernel.org; h=references:in-reply-to:message-id:date:subject:cc:to:from:from:to :cc:subject:date:message-id:reply-to:content-type; bh=KdzgWchxHHiqR+6i2dUq7NJ9e+9KXsf+Dx2VpbcxW0o=; b=Ceps4/Y/6zBVTNJv9xF7Y3Owms9wWTQP/CML4VzIr2d9wbIH9m11K3UDhiOUPdOilL nBC94nsrkjKR+I/zdzyLLufGfMy6tY0u9fAdrUCelAojgAKpgWLwtccgQPEk8v1ZCPao hvXf26e6ySi8Er1hr4PsRturvSnEVSp/lXvSYNg5K1hMOgfISo2EWsLdpnSnsTEdJZmg Nt2bf1ttZKG6qKx/7ckoevHqhagzg9G29HrzFBjMP5K2X5VPmWuvKjzUt5jEFG0GNXqC xWWjrUzAA+YeRd2L1PdzzGVdYk3I5c1MJCWfh9CJaCymdVTKvBkXbuCcAABbOHMA9+2e vUFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785928437; x=1786533237; h=references:in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KdzgWchxHHiqR+6i2dUq7NJ9e+9KXsf+Dx2VpbcxW0o=; b=h9iXyYqgAGubxXp1UjpGBaq7HuuTGql9EgB1UXJO3NdbvXnr2ghxwyL1fD9uiBE+TO 8mvkPtn4UH/yvxNalNlh6k1HF3WIewBJBFwIDn9IpynGNBJh+4UyyQXI51tQyTieBFuG PX+7MtwTY/oYGzNdgZVaOfr7+F714cc/phPyV2KyAw5bFHEbi1w5hoHUP1Cq/1060a0r ReEwOkIqIozzci4dCufjKg9nQIv+WASMA2yV/dY7zmgpvRuO0eiFuIIZgesScDwXAw9Z OLR3ZvgkZoPvWYyEkKtG6lpxkIi2ifbh7/P2NfltDLyxvbOx2RrZfZCJcAN82HwcjDY4 +67w== X-Forwarded-Encrypted: i=1; AHgh+RrbEr3vzPru0s9qVuGBHbgEl/PUGuLoV4nhlYUH4qvySg3oVZH8ZuZ1KVbfheOB/jvuzeSrUzUg+r+vc+k=@vger.kernel.org X-Gm-Message-State: AOJu0YzK6r2+Ne/7CT5DVtXCHGzh7wsprYkSk6GaF8n4EalKcz1cIhUY HsIBuxgb53bUeZhPsshUr5IzB0k79HhMLU7drUtdR6kd+FzCzQxjOrfl X-Gm-Gg: AR+sD12Zg7fuyaBsemFoTGpRTU5v60WaI5IvKb7lxg2cZ3P0HAvj4pm5iqkljOKx9lU 4yGnz6Bg2nQ6naqGZmyMI/pjW6CN1oNgtQPBymNRBpk+dS08FW668uNh2ro17urpBJjzextWc1F r8SP05fkyZQtcsbf1H4SAwOvCmF1yo1thva28/8Mq2Zf/XuePQI66tD6yXjFZrqktVzbvHud5Cr PXobZRg9N2iMsZQx/4zc30qkfcnlhC3xVLnvQDt8Zuj3z3a0EyL8/a5FUY0/8NnN4JIenUi4p6g FkF1ytAbqHW5kmzk9mN9I/nMSgtN4iLot8z42PaHHSn4FrOa2RSUo2HnTPn5i1Jl+MfUN7eZ/Wa EU2gn4Yb78QYLlY70YaM7diveg6kRI3MsLCkQFK7sPfnJkW/bAhWy6cZONfYOQfuh84qMM3o0GT Ufv2oJY/gvVd7d66XwCdcB2QjANfapNKdPWSVcE++tscDeipsqhStRmiT4jCQgWXxl2ipyORgoM LLrZLOI4xFwYn4K X-Received: by 2002:a05:6402:21ce:b0:699:fbe4:16d4 with SMTP id 4fb4d7f45d1cf-6a14f26904cmr2687562a12.18.1785928436447; Wed, 05 Aug 2026 04:13:56 -0700 (PDT) Received: from localhost (c-85-228-45-68.bbcust.telenor.se. [85.228.45.68]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6a17d6216ddsm451261a12.28.2026.08.05.04.13.55 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Wed, 05 Aug 2026 04:13:55 -0700 (PDT) From: Eli Billauer To: gregkh@linuxfoundation.org Cc: arnd@arndb.de, linux-kernel@vger.kernel.org, corbet@lwn.net, Eli Billauer Subject: [PATCH v5 2/7] char: xillybus: Remove duplicate error path code Date: Wed, 5 Aug 2026 13:13:32 +0200 Message-Id: <20260805111337.69178-3-eli.billauer@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20260805111337.69178-1-eli.billauer@gmail.com> References: <20260805111337.69178-1-eli.billauer@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Remove dedicated code for the error path, which is both redundant and incorrect: It calls kref_put() before mutex_unlock(&chan->lock). As kref_put() may result in releasing the memory containing the mutex, this could lead to UAF. Assisted-by: Deepseek:v4-pro Kimi:K2.6 ChatGPT:GPT-5.5 Claude:Sonnet-4.6 Assisted-by: Sashiko-0.2.5:gemini-3.1-pro-preview Signed-off-by: Eli Billauer --- Notes: Changelog: ========= No change on v4->v5. Changes v3->v4: -- Correct the commit description to indicate that the removed duplicate code wasn't only redundant, but could also lead to a UAF, as pointed out by Sashiko, and an attribution is hence added too. Changes v2->v3: -- Add Assisted-by tag to description No change on v1->v2. drivers/char/xillybus/xillyusb.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/char/xillybus/xillyusb.c b/drivers/char/xillybus/xillyusb.c index 560c3568fc96..ee819e2e3f82 100644 --- a/drivers/char/xillybus/xillyusb.c +++ b/drivers/char/xillybus/xillyusb.c @@ -1424,16 +1424,12 @@ static int xillyusb_open(struct inode *inode, struct file *filp) if (filp->f_mode & FMODE_WRITE) chan->open_for_write = 0; +unmutex_fail: mutex_unlock(&chan->lock); kref_put(&xdev->kref, cleanup_dev); return rc; - -unmutex_fail: - kref_put(&xdev->kref, cleanup_dev); - mutex_unlock(&chan->lock); - return rc; } static ssize_t xillyusb_read(struct file *filp, char __user *userbuf, -- 2.34.1