From: Yann Droneaud <ydroneaud@opteya.com> To: Julia Lawall <Julia.Lawall@lip6.fr>, Gilles Muller <Gilles.Muller@lip6.fr>, Nicolas Palix <nicolas.palix@imag.fr>, Michal Marek <mmarek@suse.com> Cc: Tejun Heo <tj@kernel.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, cocci@systeme.lip6.fr, linux-kernel@vger.kernel.org, Yann Droneaud <ydroneaud@opteya.com>, Pekka Enberg <penberg@cs.helsinki.fi> Subject: [PATCH 3/3] coccinelle: catch krealloc() on devm_*() allocated memory Date: Tue, 16 Feb 2016 18:06:38 +0100 [thread overview] Message-ID: <5783128fc07898adc6860a398fc4f4e0893bc91a.1455638829.git.ydroneaud@opteya.com> (raw) In-Reply-To: <cover.1455638829.git.ydroneaud@opteya.com> In-Reply-To: <cover.1455638829.git.ydroneaud@opteya.com> krealloc() must not be used against devm_*() allocated memory regions: - if a bigger memory is to be allocated, krealloc() and __krealloc() could return a different pointer than the one given to them, creating a memory region which is not managed, thus it will not be automatically released on device removal. - if a bigger memory is to be allocated, krealloc() could kfree() the managed memory region which is passed to it. The old pointer is left registered as a resource for the device. On device removal, this dangling pointer will be used and an unrelated memory region could be released. - if the requested size is equal to 0, krealloc() can also just behave like kfree(). Here too, the old pointer is kept associated with the device. On device removal, this invalid pointer will be used and an unrelated memory region could be released. For all these reasons, krealloc() must not be used on a pointer returned by devm_*() functions. Cc: Tejun Heo <tj@kernel.org> Cc: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Yann Droneaud <ydroneaud@opteya.com> --- scripts/coccinelle/free/devm_free.cocci | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/scripts/coccinelle/free/devm_free.cocci b/scripts/coccinelle/free/devm_free.cocci index 3794cd97494b..c990d2c7ee16 100644 --- a/scripts/coccinelle/free/devm_free.cocci +++ b/scripts/coccinelle/free/devm_free.cocci @@ -66,6 +66,10 @@ position p; | * kzfree@p(x) | +* __krealloc@p(x, ...) +| +* krealloc@p(x, ...) +| * free_pages@p(x, ...) | * free_page@p(x) -- 2.5.0
WARNING: multiple messages have this Message-ID (diff)
From: ydroneaud@opteya.com (Yann Droneaud) To: cocci@systeme.lip6.fr Subject: [Cocci] [PATCH 3/3] coccinelle: catch krealloc() on devm_*() allocated memory Date: Tue, 16 Feb 2016 18:06:38 +0100 [thread overview] Message-ID: <5783128fc07898adc6860a398fc4f4e0893bc91a.1455638829.git.ydroneaud@opteya.com> (raw) In-Reply-To: <cover.1455638829.git.ydroneaud@opteya.com> krealloc() must not be used against devm_*() allocated memory regions: - if a bigger memory is to be allocated, krealloc() and __krealloc() could return a different pointer than the one given to them, creating a memory region which is not managed, thus it will not be automatically released on device removal. - if a bigger memory is to be allocated, krealloc() could kfree() the managed memory region which is passed to it. The old pointer is left registered as a resource for the device. On device removal, this dangling pointer will be used and an unrelated memory region could be released. - if the requested size is equal to 0, krealloc() can also just behave like kfree(). Here too, the old pointer is kept associated with the device. On device removal, this invalid pointer will be used and an unrelated memory region could be released. For all these reasons, krealloc() must not be used on a pointer returned by devm_*() functions. Cc: Tejun Heo <tj@kernel.org> Cc: Pekka Enberg <penberg@cs.helsinki.fi> Signed-off-by: Yann Droneaud <ydroneaud@opteya.com> --- scripts/coccinelle/free/devm_free.cocci | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/scripts/coccinelle/free/devm_free.cocci b/scripts/coccinelle/free/devm_free.cocci index 3794cd97494b..c990d2c7ee16 100644 --- a/scripts/coccinelle/free/devm_free.cocci +++ b/scripts/coccinelle/free/devm_free.cocci @@ -66,6 +66,10 @@ position p; | * kzfree at p(x) | +* __krealloc at p(x, ...) +| +* krealloc at p(x, ...) +| * free_pages at p(x, ...) | * free_page at p(x) -- 2.5.0
next prev parent reply other threads:[~2016-02-16 17:52 UTC|newest] Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-02-16 17:01 [PATCH 0/3] coccinelle: catchup on memory allocation functions Yann Droneaud 2016-02-16 17:01 ` [Cocci] " Yann Droneaud 2016-02-16 17:06 ` [PATCH 1/3] coccinelle: also catch kzfree() issues Yann Droneaud 2016-02-16 17:06 ` [Cocci] " Yann Droneaud 2016-02-16 17:16 ` Julia Lawall 2016-02-16 17:16 ` [Cocci] " Julia Lawall 2016-02-16 20:02 ` SF Markus Elfring 2016-02-16 20:02 ` [Cocci] " SF Markus Elfring 2016-02-16 20:17 ` Julia Lawall 2016-02-16 20:17 ` [Cocci] " Julia Lawall 2016-02-16 20:22 ` SF Markus Elfring 2016-02-16 20:22 ` [Cocci] " SF Markus Elfring 2016-02-22 14:09 ` [PATCHv1 1/3] " Yann Droneaud 2016-02-22 14:09 ` [Cocci] " Yann Droneaud 2016-02-22 14:20 ` Julia Lawall 2016-02-22 14:20 ` [Cocci] " Julia Lawall 2016-02-22 15:24 ` Yann Droneaud 2016-02-22 15:24 ` [Cocci] " Yann Droneaud 2016-02-16 17:06 ` [PATCH 2/3] coccinelle: recognize more devm_* memory allocation functions Yann Droneaud 2016-02-16 17:06 ` [Cocci] " Yann Droneaud 2016-02-16 17:18 ` Julia Lawall 2016-02-16 17:18 ` [Cocci] " Julia Lawall 2016-02-16 17:06 ` Yann Droneaud [this message] 2016-02-16 17:06 ` [Cocci] [PATCH 3/3] coccinelle: catch krealloc() on devm_*() allocated memory Yann Droneaud 2016-02-16 17:19 ` Julia Lawall 2016-02-16 17:19 ` [Cocci] " Julia Lawall
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=5783128fc07898adc6860a398fc4f4e0893bc91a.1455638829.git.ydroneaud@opteya.com \ --to=ydroneaud@opteya.com \ --cc=Gilles.Muller@lip6.fr \ --cc=Julia.Lawall@lip6.fr \ --cc=cocci@systeme.lip6.fr \ --cc=gregkh@linuxfoundation.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mmarek@suse.com \ --cc=nicolas.palix@imag.fr \ --cc=penberg@cs.helsinki.fi \ --cc=tj@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.