From: Dan Carpenter <dan.carpenter@oracle.com>
To: "Christian König" <christian.koenig@amd.com>
Cc: Charan Teja Kalla <quic_charante@quicinc.com>,
"T.J. Mercier" <tjmercier@google.com>,
dri-devel@lists.freedesktop.org
Subject: Re: [bug report] dma-buf: call dma_buf_stats_setup after dmabuf is in valid list
Date: Mon, 16 May 2022 11:47:04 +0300 [thread overview]
Message-ID: <20220516084704.GG29930@kadam> (raw)
In-Reply-To: <796f913e-3b4d-23dd-e3d6-d1acd840ddf7@amd.com>
On Mon, May 16, 2022 at 09:18:55AM +0200, Christian König wrote:
> > > 557
> > > 558 return dmabuf;
> > > 559
> > > 560 err_sysfs:
> > > 561 /*
> > > 562 * Set file->f_path.dentry->d_fsdata to NULL so that when
> > > 563 * dma_buf_release() gets invoked by dentry_ops, it exits
> > > 564 * early before calling the release() dma_buf op.
> > > 565 */
> > > 566 file->f_path.dentry->d_fsdata = NULL;
> > > 567 fput(file);
> > > 568 err_dmabuf:
> > > 569 kfree(dmabuf);
> > >
> > > dmabuf is freed, but it's still on the list so it leads to a use after
> > > free.
> > This seems to be a false positive. On closing the file @line no:567, it
> > ends up calling dma_buf_file_release() which does remove dmabuf from its
> > list.
>
> Yeah, correct as far as I can see. The checker just can't see that the fput
> will cleanup the list.
Yep. Thanks!
I hope that that Smatch will be better at parsing the fput() by the end
of the year but right now it doesn't work at all.
regards,
dan carpenter
prev parent reply other threads:[~2022-05-16 8:47 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-16 6:49 [bug report] dma-buf: call dma_buf_stats_setup after dmabuf is in valid list Dan Carpenter
2022-05-16 7:13 ` Charan Teja Kalla
2022-05-16 7:18 ` Christian König
2022-05-16 8:47 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220516084704.GG29930@kadam \
--to=dan.carpenter@oracle.com \
--cc=christian.koenig@amd.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=quic_charante@quicinc.com \
--cc=tjmercier@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.