From: Chris Wilson <chris@chris-wilson.co.uk>
To: Takashi Iwai <tiwai@suse.de>,
intel-gfx@lists.freedesktop.org,
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>,
Jerome Anand <jerome.anand@intel.com>,
Jani Nikula <jani.nikula@intel.com>
Subject: Re: [PATCH] drm/i915: Fix use after free in lpe_audio_platdev_destroy()
Date: Tue, 11 Apr 2017 22:27:07 +0100 [thread overview]
Message-ID: <20170411212707.GC4250@nuc-i3427.alporthouse.com> (raw)
In-Reply-To: <20170411212056.GB4250@nuc-i3427.alporthouse.com>
On Tue, Apr 11, 2017 at 10:20:56PM +0100, Chris Wilson wrote:
> On Tue, Apr 11, 2017 at 11:01:57PM +0200, Takashi Iwai wrote:
> > On Tue, 11 Apr 2017 22:41:12 +0200,
> > Chris Wilson wrote:
> > Oh, this fell into a crack as it was sent just before my vacation.
> >
> > About the change:
> >
> > > > ---
> > > > drivers/gpu/drm/i915/intel_lpe_audio.c | 8 ++++++--
> > > > 1 file changed, 6 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
> > > > index 7a5b41b1c024..32000902a204 100644
> > > > --- a/drivers/gpu/drm/i915/intel_lpe_audio.c
> > > > +++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
> > > > @@ -131,8 +131,12 @@ lpe_audio_platdev_create(struct drm_i915_private *dev_priv)
> > > >
> > > > static void lpe_audio_platdev_destroy(struct drm_i915_private *dev_priv)
> > > > {
> > > > - platform_device_unregister(dev_priv->lpe_audio.platdev);
> > > > - kfree(dev_priv->lpe_audio.platdev->dev.dma_mask);
> > > > + struct platform_device *platdev = dev_priv->lpe_audio.platdev;
> > > > +
> > > > + kfree(platdev->dev.dma_mask);
> > > > + platdev->dev.dma_mask = NULL;
> > > > +
> > > > + platform_device_unregister(platdev);
> >
> > I'm not sure whether it's good idea to fiddle dma_mask bits before the
> > unregister call. Interestingly, this is the only driver that calls
> > kfree() for pdev's dma_mask. Either we do something wrong, or
> > everyone forgot this?
>
> Afaict, everyone else chose the blissful ignorance strategy and we are
> the only fools to try and free the dma_mask.
>
> Would you feel more comfortable with:
>
> void *mask = platdev->dev.dma_mask;
>
> platform_device_unregister(platdev);
>
> /* XXX see platform_device_register_full():
> * "This memory isn't freed when the device is put."
> * It's not clear why it hasn't been fixed in a decade...
> */
> kfree(mask);
Still has the issue that unregister may not the final put, it should but
still...
I think we just leak the memory. We are not the owner and so shouldn't
be fiddling around trying to free it.
-Chris
--
Chris Wilson, Intel Open Source Technology Centre
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
next prev parent reply other threads:[~2017-04-11 21:27 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-01 18:59 [PATCH] drm/i915: Fix use after free in lpe_audio_platdev_destroy() Chris Wilson
2017-03-01 20:17 ` ✓ Fi.CI.BAT: success for " Patchwork
2017-04-11 20:41 ` [PATCH] " Chris Wilson
2017-04-11 21:01 ` Takashi Iwai
2017-04-11 21:20 ` Chris Wilson
2017-04-11 21:27 ` Chris Wilson [this message]
2017-04-12 4:59 ` Takashi Iwai
2017-04-12 7:46 ` Ville Syrjälä
2017-04-12 8:25 ` Chris Wilson
2017-04-12 8:02 ` [PATCH v2] " Chris Wilson
2017-04-12 11:42 ` Takashi Iwai
2017-04-12 19:19 ` Ville Syrjälä
2017-04-12 21:55 ` Chris Wilson
2017-04-12 8:22 ` ✓ Fi.CI.BAT: success for drm/i915: Fix use after free in lpe_audio_platdev_destroy() (rev2) Patchwork
2017-04-12 8:31 ` [PATCH v3] drm/i915: Fix use after free in lpe_audio_platdev_destroy() Chris Wilson
2017-04-12 8:52 ` Ville Syrjälä
2017-04-12 9:03 ` Chris Wilson
2017-04-12 11:41 ` Takashi Iwai
2017-04-12 19:17 ` Ville Syrjälä
2017-04-12 8:51 ` ✓ Fi.CI.BAT: success for drm/i915: Fix use after free in lpe_audio_platdev_destroy() (rev4) Patchwork
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170411212707.GC4250@nuc-i3427.alporthouse.com \
--to=chris@chris-wilson.co.uk \
--cc=intel-gfx@lists.freedesktop.org \
--cc=jani.nikula@intel.com \
--cc=jerome.anand@intel.com \
--cc=pierre-louis.bossart@linux.intel.com \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.