Messages in this thread |  | | Date | Sun, 10 Apr 2022 11:27:09 +0200 | Subject | Re: [PATCH] drivers: nfc: nfcmrvl: fix double free bug in nfcmrvl_nci_unregister_dev() | From | Krzysztof Kozlowski <> |
| |
On 10/04/2022 10:31, Duoming Zhou wrote: > There is a potential double bug in nfcmrvl usb driver between > unregister and resume operation. >
Thank you for your patch. There is something to discuss/improve.
> The race that cause that double free bug can be shown as below:
Your patch solves the most visible race, but because of lack of locking, I believe race still might exist:
(FREE) | (USE) | nfcmrvl_resume | nfcmrvl_submit_bulk_urb | nfcmrvl_bulk_complete | nfcmrvl_nci_recv_frame | nfcmrvl_fw_dnld_recv_frame | queue_work | fw_dnld_rx_work nfcmrvl_disconnect | nfcmrvl_nci_unregister_dev | nfcmrvl_fw_dnld_deinit | wait for the workqueue to finish | | fw_dnld_over | release_firmware | kfree(fw); | no synchronization //(1) if (fw_download_in_progress) - no synchronization, so CPU sees old value nfcmrvl_fw_dnld_abort | fw_dnld_over | ... if (priv->fw_dnld.fw) | release_firmware | kfree(fw); //(2) | ... | fw = NULL;
The kfree() from (2) would still free old value. Even if fw=NULL happens earlier, it is not propagated back to the other CPU, unless there are some implicit barriers due to workqueue?
Is it safe then to rely on such implicit barriers from workqueue?
> > (FREE) | (USE) > | nfcmrvl_resume > | nfcmrvl_submit_bulk_urb > | nfcmrvl_bulk_complete > | nfcmrvl_nci_recv_frame > | nfcmrvl_fw_dnld_recv_frame > | queue_work > | fw_dnld_rx_work > | fw_dnld_over > | release_firmware > | kfree(fw); //(1) > nfcmrvl_disconnect | > nfcmrvl_nci_unregister_dev | > nfcmrvl_fw_dnld_abort | > fw_dnld_over | ... > if (priv->fw_dnld.fw) | > release_firmware | > kfree(fw); //(2) | > ... | fw = NULL; >
Best regards, Krzysztof
|  |