* [PATCH v3] iio: core: fix double free in iio_device_unregister_sysfs()
@ 2021-10-13 3:05 Yang Yingliang
[not found] ` <CAHp75VeyQYmKybQwWLmM2QxVQXomrUH0RttRguzRyoWXtc3TFA@mail.gmail.com>
0 siblings, 1 reply; 2+ messages in thread
From: Yang Yingliang @ 2021-10-13 3:05 UTC (permalink / raw)
To: linux-kernel, linux-iio; +Cc: lars, jic23, alexandru.ardelean, andy.shevchenko
I got the double free report:
BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
kfree+0xce/0x390
iio_device_unregister_sysfs+0x108/0x13b [industrialio]
iio_dev_release+0x9e/0x10e [industrialio]
device_release+0xa5/0x240
kobject_put+0x1e5/0x540
put_device+0x20/0x30
devm_iio_device_release+0x21/0x30 [industrialio]
If __iio_device_register() fails, iio_dev_opaque->groups will be freed
in error path in iio_device_unregister_sysfs(), then iio_dev_release()
will call iio_device_unregister_sysfs() again, it causes double free.
Set iio_dev_opaque->groups to NULL when it's freed to fix this double free.
Fixes: 32f171724e5c ("iio: core: rework iio device group creation")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
v1 -> v3:
reduce some backtrace in commit message
---
drivers/iio/industrialio-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 2dbb37e09b8c..2dc837db50f7 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -1600,6 +1600,7 @@ static void iio_device_unregister_sysfs(struct iio_dev *indio_dev)
kfree(iio_dev_opaque->chan_attr_group.attrs);
iio_dev_opaque->chan_attr_group.attrs = NULL;
kfree(iio_dev_opaque->groups);
+ iio_dev_opaque->groups = NULL;
}
static void iio_dev_release(struct device *device)
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v3] iio: core: fix double free in iio_device_unregister_sysfs()
[not found] ` <CAHp75VdH2CkY-e6P6QvMzDXK6F9boxz4Vb5trwmMoPOCTmkjww@mail.gmail.com>
@ 2021-10-17 16:15 ` Jonathan Cameron
0 siblings, 0 replies; 2+ messages in thread
From: Jonathan Cameron @ 2021-10-17 16:15 UTC (permalink / raw)
To: Andy Shevchenko
Cc: Yang Yingliang, linux-kernel, linux-iio, lars, alexandru.ardelean
On Wed, 13 Oct 2021 08:51:38 +0300
Andy Shevchenko <andy.shevchenko@gmail.com> wrote:
> On Wednesday, October 13, 2021, Andy Shevchenko <andy.shevchenko@gmail.com>
> wrote:
>
> >
> >
> > On Wednesday, October 13, 2021, Yang Yingliang <yangyingliang@huawei.com>
> > wrote:
> >
> >> I got the double free report:
> >>
> >> BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
> >
> >
> >
> >> kfree+0xce/0x390
> >
> >
> >
> > This line also redundant, but no need to resend, I hope Jonathan can do it
> > for you.
> >
> >
> >> iio_device_unregister_sysfs+0x108/0x13b [industrialio]
> >> iio_dev_release+0x9e/0x10e [
> >
> >
> >>
>
>
> >
> >> device_release+0xa5/0x240
> >> kobject_put+0x1e5/0x540
> >> put_device+0x20/0x30
> >> devm_iio_device_release+0x21/0x30 [industrialio]
> >
> >
> >>
> Actually above lines are also part of the noise
Not sure I'm quite so keen to strip everything back completely (though I do
agree keeping it fairly minimal is good.
Anyhow, tidied it up a bit and applied. I also added a note that more
radical surgery is needed to clean up the lifetime management but in the
meantime this deals with the symptoms.
Applied to the fixes-togreg branch of iio.git and marked for stable.
Thanks,
Jonathan
>
>
> >
> >> If __iio_device_register() fails, iio_dev_opaque->groups will be freed
> >> in error path in iio_device_unregister_sysfs(), then iio_dev_release()
> >> will call iio_device_unregister_sysfs() again, it causes double free.
> >> Set iio_dev_opaque->groups to NULL when it's freed to fix this double
> >> free.
> >>
> >> Fixes: 32f171724e5c ("iio: core: rework iio device group creation")
> >> Reported-by: Hulk Robot <hulkci@huawei.com>
> >> Reviewed-by: Alexandru Ardelean <ardeleanalex@gmail.com>
> >> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
> >> ---
> >> v1 -> v3:
> >> reduce some backtrace in commit message
> >> ---
> >> drivers/iio/industrialio-core.c | 1 +
> >> 1 file changed, 1 insertion(+)
> >>
> >> diff --git a/drivers/iio/industrialio-core.c
> >> b/drivers/iio/industrialio-core.c
> >> index 2dbb37e09b8c..2dc837db50f7 100644
> >> --- a/drivers/iio/industrialio-core.c
> >> +++ b/drivers/iio/industrialio-core.c
> >> @@ -1600,6 +1600,7 @@ static void iio_device_unregister_sysfs(struct
> >> iio_dev *indio_dev)
> >> kfree(iio_dev_opaque->chan_attr_group.attrs);
> >> iio_dev_opaque->chan_attr_group.attrs = NULL;
> >> kfree(iio_dev_opaque->groups);
> >> + iio_dev_opaque->groups = NULL;
> >> }
> >>
> >> static void iio_dev_release(struct device *device)
> >> --
> >> 2.25.1
> >
> >
>
>
>
>
>
>
>
>
> >
> >>
> >>
> >
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> >
> >
> > --
> > With Best Regards,
> > Andy Shevchenko
> >
> >
> >
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-10-17 16:10 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-13 3:05 [PATCH v3] iio: core: fix double free in iio_device_unregister_sysfs() Yang Yingliang
[not found] ` <CAHp75VeyQYmKybQwWLmM2QxVQXomrUH0RttRguzRyoWXtc3TFA@mail.gmail.com>
[not found] ` <CAHp75VdH2CkY-e6P6QvMzDXK6F9boxz4Vb5trwmMoPOCTmkjww@mail.gmail.com>
2021-10-17 16:15 ` Jonathan Cameron
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.