mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Tejun Heo <tj@kernel.org>
To: Luis Chamberlain <mcgrof@kernel.org>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>,
	Matthieu Castet <castet.matthieu@free.fr>,
	Stanislaw Gruszka <stf_xl@wp.pl>,
	ming.lei@redhat.com, Hillf Danton <hdanton@sina.com>,
	syzbot <syzbot+6bc35f3913193fe7f0d3@syzkaller.appspotmail.com>,
	linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Read in kernfs_next_descendant_post (2)
Date: Tue, 15 Nov 2022 12:14:06 -1000	[thread overview]
Message-ID: <Y3QPLje5yYEZdPc6@slm.duckdns.org> (raw)
In-Reply-To: <Y3Pp7geXZRX3ltNg@bombadil.infradead.org>

On Tue, Nov 15, 2022 at 11:35:10AM -0800, Luis Chamberlain wrote:
> request_firmware_nowait() is documented as requiring the caller to
> ensure to maintain the the reference count of @device during the
> lifetime of the call to request_firmware_nowait() and the callback.

My reading was that just holding the ref isn't enough. The code expects the
device to be not destroyed independent of the refcnt. I don't see how this
would be fixed by diddling with refcnt.

Thanks.

-- 
tejun

  parent reply	other threads:[~2022-11-15 22:14 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-04 12:57 syzbot
2022-10-20  7:15 ` syzbot
     [not found]   ` <20221021225228.1750-1-hdanton@sina.com>
2022-10-22  6:55     ` syzbot
2022-10-31 22:53     ` Tejun Heo
2022-11-14 17:34       ` Luis Chamberlain
2022-11-14 18:07         ` Dmitry Torokhov
2022-11-15 19:35           ` Luis Chamberlain
2022-11-15 20:12             ` Dmitry Torokhov
2022-11-15 22:14             ` Tejun Heo [this message]
2022-11-15  6:27         ` Dmitry Vyukov
     [not found] <20221020105004.1341-1-hdanton@sina.com>
2022-10-20 21:30 ` syzbot
     [not found] <20221021032341.1481-1-hdanton@sina.com>
2022-10-21  3:45 ` syzbot
     [not found] <20221021071306.1535-1-hdanton@sina.com>
2022-10-21  7:29 ` syzbot
     [not found] <20221021092625.1602-1-hdanton@sina.com>
2022-10-21  9:44 ` syzbot
     [not found] <20221021133530.1693-1-hdanton@sina.com>
2022-10-21 13:59 ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Y3QPLje5yYEZdPc6@slm.duckdns.org \
    --to=tj@kernel.org \
    --cc=castet.matthieu@free.fr \
    --cc=dmitry.torokhov@gmail.com \
    --cc=hdanton@sina.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mcgrof@kernel.org \
    --cc=ming.lei@redhat.com \
    --cc=stf_xl@wp.pl \
    --cc=syzbot+6bc35f3913193fe7f0d3@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®