Re: [PATCH net] 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition

[kernel test robot <lkp@intel.com>]

Hi Zheng,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on net/master]

url:    https://github.com/intel-lab-lkp/linux/commits/Zheng-Wang/9p-xen-Fix-use-after-free-bug-in-xen_9pfs_front_remove-due-to-race-condition/20230313-121534
patch link:    https://lore.kernel.org/r/20230313041303.3158458-1-zyytlz.wz%40163.com
patch subject: [PATCH net] 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
config: arm-randconfig-r046-20230313 (https://download.01.org/0day-ci/archive/20230313/202303131508.drILo2xA-lkp@intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 12.1.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/intel-lab-lkp/linux/commit/bf2159b54bb14c42221106b8681c471d005e7345
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review Zheng-Wang/9p-xen-Fix-use-after-free-bug-in-xen_9pfs_front_remove-due-to-race-condition/20230313-121534
        git checkout bf2159b54bb14c42221106b8681c471d005e7345
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=arm olddefconfig
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=arm SHELL=/bin/bash net/9p/

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
| Link: https://lore.kernel.org/oe-kbuild-all/202303131508.drILo2xA-lkp@intel.com/

All errors (new ones prefixed by >>):

   net/9p/trans_xen.c: In function 'xen_9pfs_front_free':
>> net/9p/trans_xen.c:284:24: error: incompatible types when assigning to type 'struct xen_9pfs_dataring *' from type 'struct xen_9pfs_dataring'
     284 |                 ring = priv->rings[i];
         |                        ^~~~


vim +284 net/9p/trans_xen.c

   273	
   274	static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv)
   275	{
   276		int i, j;
   277		struct xen_9pfs_dataring *ring = NULL;
   278	
   279		write_lock(&xen_9pfs_lock);
   280		list_del(&priv->list);
   281		write_unlock(&xen_9pfs_lock);
   282	
   283		for (i = 0; i < priv->num_rings; i++) {
 > 284			ring = priv->rings[i];
   285			if (!priv->rings[i].intf)
   286				break;
   287			if (priv->rings[i].irq > 0)
   288				unbind_from_irqhandler(priv->rings[i].irq, priv->dev);
   289	
   290			cancel_work_sync(&ring->work);
   291	
   292			if (priv->rings[i].data.in) {
   293				for (j = 0;
   294				     j < (1 << priv->rings[i].intf->ring_order);
   295				     j++) {
   296					grant_ref_t ref;
   297	
   298					ref = priv->rings[i].intf->ref[j];
   299					gnttab_end_foreign_access(ref, NULL);
   300				}
   301				free_pages_exact(priv->rings[i].data.in,
   302					   1UL << (priv->rings[i].intf->ring_order +
   303						   XEN_PAGE_SHIFT));
   304			}
   305			gnttab_end_foreign_access(priv->rings[i].ref, NULL);
   306			free_page((unsigned long)priv->rings[i].intf);
   307		}
   308		kfree(priv->rings);
   309		kfree(priv->tag);
   310		kfree(priv);
   311	}
   312	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests