Re: [bug report] iwpm: crash fix for large connections test

[Dan Carpenter <error27@xxxxxxxxx>]

So the background here is that Smatch sees this:

	kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);

and correctly says "if we call iwpm_free_nlmsg_request() then
dereferencing nlmsg_request is a use after free".  However, the code
is holding two references at this point so it will never call
iwpm_free_nlmsg_request().

Smatch already checks to see if we are holding two references, but it
doesn't parse this code correctly.  Smatch could be fixed, but there are
other places with similar warnings that are more difficult to fix.

What we could do is create a kref_no_release() function that just calls
WARN().  This would silence the warning and, I think, this would make
the code more readable.

What do other people think?

regards,
dan carpenter

diff --git a/include/linux/kref.h b/include/linux/kref.h
index d32e21a2538c..f40089f61aa6 100644
--- a/include/linux/kref.h
+++ b/include/linux/kref.h
@@ -45,6 +45,11 @@ static inline void kref_get(struct kref *kref)
 	refcount_inc(&kref->refcount);
 }
 
+static inline void kref_no_release(struct kref *kref)
+{
+	WARN(1, "Unexpected kref release");
+}
+
 /**
  * kref_put - decrement refcount for object.
  * @kref: object.
diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index 3c9a9869212b..1acb96bfaf9c 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -432,7 +432,7 @@ int iwpm_register_pid_cb(struct sk_buff *skb, struct netlink_callback *cb)
 register_pid_response_exit:
 	nlmsg_request->request_done = 1;
 	/* always for found nlmsg_request */
-	kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);
+	kref_put(&nlmsg_request->kref, kref_no_release);
 	barrier();
 	up(&nlmsg_request->sem);
 	return 0;
@@ -504,7 +504,7 @@ int iwpm_add_mapping_cb(struct sk_buff *skb, struct netlink_callback *cb)
 add_mapping_response_exit:
 	nlmsg_request->request_done = 1;
 	/* always for found request */
-	kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);
+	kref_put(&nlmsg_request->kref, kref_no_release);
 	barrier();
 	up(&nlmsg_request->sem);
 	return 0;
@@ -602,7 +602,7 @@ int iwpm_add_and_query_mapping_cb(struct sk_buff *skb,
 query_mapping_response_exit:
 	nlmsg_request->request_done = 1;
 	/* always for found request */
-	kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);
+	kref_put(&nlmsg_request->kref, kref_no_release);
 	barrier();
 	up(&nlmsg_request->sem);
 	return 0;
@@ -801,7 +801,7 @@ int iwpm_mapping_error_cb(struct sk_buff *skb, struct netlink_callback *cb)
 	nlmsg_request->err_code = err_code;
 	nlmsg_request->request_done = 1;
 	/* always for found request */
-	kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);
+	kref_put(&nlmsg_request->kref, kref_no_release);
 	barrier();
 	up(&nlmsg_request->sem);
 	return 0;