Messages in this thread | | | From | Jia-Ju Bai <> | Subject | [BUG] net: brocade: bna: Possible concurrency use-after-free bugs | Date | Wed, 26 Dec 2018 22:35:45 +0800 |
| |
In drivers/net/ethernet/brocade/bna/bnad_debugfs.c, the functions bnad_debugfs_read_regrd() and bnad_debugfs_write_regrd() may be concurrently executed.
bnad_debugfs_read_regrd() line 293: if (!bnad->regdata) line 297: simple_read_from_buffer(..., bnad->regdata, ...) line 300: kfree(bnad->regdata)
bnad_debugfs_write_regrd() line 335: kfree(bnad->regdata) line 338: kfree(bnad->regdata) line 357: regbuf = (u32 *)bnad->regdata
All these accesses to bnad->regdata are not protected by any lock. Thus, possible concurrency use-after-free bugs may occur.
A possible fixing way is to use a lock to protect these accesses. I am not sure about this way, so I only report the bugs.
Best wishes, Jia-Ju Bai
| |