* [bug report] iommu/arm-smmu: Make use of the iommu_register interface
@ 2017-02-15 8:36 Dan Carpenter
2017-02-22 11:00 ` Joerg Roedel
0 siblings, 1 reply; 5+ messages in thread
From: Dan Carpenter @ 2017-02-15 8:36 UTC (permalink / raw)
To: jroedel-l3A5Bk7waGM; +Cc: iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA
Hello Joerg Roedel,
This is a semi-automatic email about new static checker warnings.
The patch 9648cbc9625b: "iommu/arm-smmu: Make use of the
iommu_register interface" from Feb 1, 2017, leads to the following
Smatch complaint:
drivers/iommu/arm-smmu-v3.c:1810 arm_smmu_remove_device()
warn: variable dereferenced before check 'master' (see line 1809)
drivers/iommu/arm-smmu-v3.c
1808 master = fwspec->iommu_priv;
1809 smmu = master->smmu;
^^^^^^^^^^^^
New dereference.
1810 if (master && master->ste.valid)
^^^^^^
Old code checked for NULL.
1811 arm_smmu_detach_dev(dev);
1812 iommu_group_remove_device(dev);
regards,
dan carpenter
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [bug report] iommu/arm-smmu: Make use of the iommu_register interface
2017-02-15 8:36 [bug report] iommu/arm-smmu: Make use of the iommu_register interface Dan Carpenter
@ 2017-02-22 11:00 ` Joerg Roedel
[not found] ` <20170222110042.GC4154-l3A5Bk7waGM@public.gmane.org>
0 siblings, 1 reply; 5+ messages in thread
From: Joerg Roedel @ 2017-02-22 11:00 UTC (permalink / raw)
To: Dan Carpenter
Cc: will.deacon-5wv7dgnIgG8,
iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA
Hi Dan,
thanks for the report! There are more bogus things going on here.
On Wed, Feb 15, 2017 at 11:36:48AM +0300, Dan Carpenter wrote:
> The patch 9648cbc9625b: "iommu/arm-smmu: Make use of the
> iommu_register interface" from Feb 1, 2017, leads to the following
> Smatch complaint:
>
> drivers/iommu/arm-smmu-v3.c:1810 arm_smmu_remove_device()
> warn: variable dereferenced before check 'master' (see line 1809)
>
> drivers/iommu/arm-smmu-v3.c
> 1808 master = fwspec->iommu_priv;
> 1809 smmu = master->smmu;
> ^^^^^^^^^^^^
> New dereference.
>
> 1810 if (master && master->ste.valid)
> ^^^^^^
> Old code checked for NULL.
>
> 1811 arm_smmu_detach_dev(dev);
> 1812 iommu_group_remove_device(dev);
So the master pointer comes from fwspec->iommu_priv, and master is freed
later in the function. But I can't find where the fwspec->iommu_priv
pointer is cleared. To me it looks like this breaks when a device is
removed and the added again.
Robin, Will, can you have a look please?
Thanks,
Joerg
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [bug report] iommu/arm-smmu: Make use of the iommu_register interface
[not found] ` <20170222110042.GC4154-l3A5Bk7waGM@public.gmane.org>
@ 2017-02-22 11:26 ` Robin Murphy
[not found] ` <96801505-0808-1ab0-8d10-2b6f22bec35f-5wv7dgnIgG8@public.gmane.org>
0 siblings, 1 reply; 5+ messages in thread
From: Robin Murphy @ 2017-02-22 11:26 UTC (permalink / raw)
To: Joerg Roedel, Dan Carpenter
Cc: iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
will.deacon-5wv7dgnIgG8
On 22/02/17 11:00, Joerg Roedel wrote:
> Hi Dan,
>
> thanks for the report! There are more bogus things going on here.
>
> On Wed, Feb 15, 2017 at 11:36:48AM +0300, Dan Carpenter wrote:
>> The patch 9648cbc9625b: "iommu/arm-smmu: Make use of the
>> iommu_register interface" from Feb 1, 2017, leads to the following
>> Smatch complaint:
>>
>> drivers/iommu/arm-smmu-v3.c:1810 arm_smmu_remove_device()
>> warn: variable dereferenced before check 'master' (see line 1809)
>>
>> drivers/iommu/arm-smmu-v3.c
>> 1808 master = fwspec->iommu_priv;
>> 1809 smmu = master->smmu;
>> ^^^^^^^^^^^^
>> New dereference.
>>
>> 1810 if (master && master->ste.valid)
>> ^^^^^^
>> Old code checked for NULL.
>>
>> 1811 arm_smmu_detach_dev(dev);
>> 1812 iommu_group_remove_device(dev);
>
> So the master pointer comes from fwspec->iommu_priv, and master is freed
> later in the function. But I can't find where the fwspec->iommu_priv
> pointer is cleared. To me it looks like this breaks when a device is
> removed and the added again.
The pointer isn't cleared because the whole fwspec is freed on the very
next line.
Robin.
>
> Robin, Will, can you have a look please?
>
>
> Thanks,
>
> Joerg
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [bug report] iommu/arm-smmu: Make use of the iommu_register interface
[not found] ` <96801505-0808-1ab0-8d10-2b6f22bec35f-5wv7dgnIgG8@public.gmane.org>
@ 2017-02-22 12:17 ` Joerg Roedel
0 siblings, 0 replies; 5+ messages in thread
From: Joerg Roedel @ 2017-02-22 12:17 UTC (permalink / raw)
To: Robin Murphy
Cc: iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA,
will.deacon-5wv7dgnIgG8, Dan Carpenter
On Wed, Feb 22, 2017 at 11:26:48AM +0000, Robin Murphy wrote:
> The pointer isn't cleared because the whole fwspec is freed on the very
> next line.
You are right, stupid me :/ Sorry for the noise.
Joerg
^ permalink raw reply [flat|nested] 5+ messages in thread
* [bug report] iommu/arm-smmu: Make use of the iommu_register interface
@ 2018-03-05 14:33 Dan Carpenter
0 siblings, 0 replies; 5+ messages in thread
From: Dan Carpenter @ 2018-03-05 14:33 UTC (permalink / raw)
To: jroedel-l3A5Bk7waGM; +Cc: iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA
Hello Joerg Roedel,
This is a semi-automatic email about new static checker warnings.
The patch 9648cbc9625b: "iommu/arm-smmu: Make use of the
iommu_register interface" from Feb 1, 2017, leads to the following
Smatch complaint:
./drivers/iommu/arm-smmu-v3.c:1957 arm_smmu_remove_device()
warn: variable dereferenced before check 'master' (see line 1956)
./drivers/iommu/arm-smmu-v3.c
1955 master = fwspec->iommu_priv;
1956 smmu = master->smmu;
^^^^^^^^^^^^
Pach adds unchecked dereference
1957 if (master && master->ste.assigned)
^^^^^^
The old code assumes "master" can be NULL.
1958 arm_smmu_detach_dev(dev);
1959 iommu_group_remove_device(dev);
regards,
dan carpenter
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-03-05 14:33 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-15 8:36 [bug report] iommu/arm-smmu: Make use of the iommu_register interface Dan Carpenter
2017-02-22 11:00 ` Joerg Roedel
[not found] ` <20170222110042.GC4154-l3A5Bk7waGM@public.gmane.org>
2017-02-22 11:26 ` Robin Murphy
[not found] ` <96801505-0808-1ab0-8d10-2b6f22bec35f-5wv7dgnIgG8@public.gmane.org>
2017-02-22 12:17 ` Joerg Roedel
2018-03-05 14:33 Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.