[BUG] net: brocade: bna: Possible concurrency use-after-free bugs
From: Jia-Ju Bai <hidden>
Date: 2018-12-26 14:35:59
Also in:
lkml
From: Jia-Ju Bai <hidden>
Date: 2018-12-26 14:35:59
Also in:
lkml
In drivers/net/ethernet/brocade/bna/bnad_debugfs.c, the functions bnad_debugfs_read_regrd() and bnad_debugfs_write_regrd() may be concurrently executed. bnad_debugfs_read_regrd() line 293: if (!bnad->regdata) line 297: simple_read_from_buffer(..., bnad->regdata, ...) line 300: kfree(bnad->regdata) bnad_debugfs_write_regrd() line 335: kfree(bnad->regdata) line 338: kfree(bnad->regdata) line 357: regbuf = (u32 *)bnad->regdata All these accesses to bnad->regdata are not protected by any lock. Thus, possible concurrency use-after-free bugs may occur. A possible fixing way is to use a lock to protect these accesses. I am not sure about this way, so I only report the bugs. Best wishes, Jia-Ju Bai