All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] staging: vchiq_arm: check vchiq_instance for NULL before dereferencing
@ 2022-06-14 18:25 ` Adrien Thierry
  0 siblings, 0 replies; 4+ messages in thread
From: Adrien Thierry @ 2022-06-14 18:25 UTC (permalink / raw)
  To: Florian Fainelli, Broadcom internal kernel review list,
	Greg Kroah-Hartman
  Cc: Dan Carpenter, Adrien Thierry, linux-rpi-kernel,
	linux-arm-kernel, linux-staging

In service_callback(), the vchiq_instance is checked for NULL after
dereferencing it. Switch the order of those operations.

This was reported by https://lore.kernel.org/all/Yqc+Oavmh0zMRVPQ@kili/

I moved the NULL check before the call to rcu_read_lock() since access
to the vchiq_instance is not RCU-protected (the RCU is only used to
access the vchiq_service).

Signed-off-by: Adrien Thierry <athierry@redhat.com>
---
 .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 3bcb893d14a1..ba1f86799b7f 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -1058,6 +1058,9 @@ service_callback(struct vchiq_instance *instance, enum vchiq_reason reason,
 
 	DEBUG_TRACE(SERVICE_CALLBACK_LINE);
 
+	if (!instance || instance->closing)
+		return VCHIQ_SUCCESS;
+
 	rcu_read_lock();
 	service = handle_to_service(instance, handle);
 	if (WARN_ON(!service)) {
@@ -1067,11 +1070,6 @@ service_callback(struct vchiq_instance *instance, enum vchiq_reason reason,
 
 	user_service = (struct user_service *)service->base.userdata;
 
-	if (!instance || instance->closing) {
-		rcu_read_unlock();
-		return VCHIQ_SUCCESS;
-	}
-
 	/*
 	 * As hopping around different synchronization mechanism,
 	 * taking an extra reference results in simpler implementation.

base-commit: de9257ae1d3b0d8856955045d194e3ff4f278394
-- 
2.35.3


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* [PATCH] staging: vchiq_arm: check vchiq_instance for NULL before dereferencing
@ 2022-06-14 18:25 ` Adrien Thierry
  0 siblings, 0 replies; 4+ messages in thread
From: Adrien Thierry @ 2022-06-14 18:25 UTC (permalink / raw)
  To: Florian Fainelli, Broadcom internal kernel review list,
	Greg Kroah-Hartman
  Cc: Dan Carpenter, Adrien Thierry, linux-rpi-kernel,
	linux-arm-kernel, linux-staging

In service_callback(), the vchiq_instance is checked for NULL after
dereferencing it. Switch the order of those operations.

This was reported by https://lore.kernel.org/all/Yqc+Oavmh0zMRVPQ@kili/

I moved the NULL check before the call to rcu_read_lock() since access
to the vchiq_instance is not RCU-protected (the RCU is only used to
access the vchiq_service).

Signed-off-by: Adrien Thierry <athierry@redhat.com>
---
 .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 3bcb893d14a1..ba1f86799b7f 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -1058,6 +1058,9 @@ service_callback(struct vchiq_instance *instance, enum vchiq_reason reason,
 
 	DEBUG_TRACE(SERVICE_CALLBACK_LINE);
 
+	if (!instance || instance->closing)
+		return VCHIQ_SUCCESS;
+
 	rcu_read_lock();
 	service = handle_to_service(instance, handle);
 	if (WARN_ON(!service)) {
@@ -1067,11 +1070,6 @@ service_callback(struct vchiq_instance *instance, enum vchiq_reason reason,
 
 	user_service = (struct user_service *)service->base.userdata;
 
-	if (!instance || instance->closing) {
-		rcu_read_unlock();
-		return VCHIQ_SUCCESS;
-	}
-
 	/*
 	 * As hopping around different synchronization mechanism,
 	 * taking an extra reference results in simpler implementation.

base-commit: de9257ae1d3b0d8856955045d194e3ff4f278394
-- 
2.35.3


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH] staging: vchiq_arm: check vchiq_instance for NULL before dereferencing
  2022-06-14 18:25 ` Adrien Thierry
@ 2022-06-17  9:53   ` Greg Kroah-Hartman
  -1 siblings, 0 replies; 4+ messages in thread
From: Greg Kroah-Hartman @ 2022-06-17  9:53 UTC (permalink / raw)
  To: Adrien Thierry
  Cc: Florian Fainelli, Broadcom internal kernel review list,
	Dan Carpenter, linux-rpi-kernel, linux-arm-kernel, linux-staging

On Tue, Jun 14, 2022 at 02:25:44PM -0400, Adrien Thierry wrote:
> In service_callback(), the vchiq_instance is checked for NULL after
> dereferencing it. Switch the order of those operations.
> 
> This was reported by https://lore.kernel.org/all/Yqc+Oavmh0zMRVPQ@kili/
> 
> I moved the NULL check before the call to rcu_read_lock() since access
> to the vchiq_instance is not RCU-protected (the RCU is only used to
> access the vchiq_service).
> 
> Signed-off-by: Adrien Thierry <athierry@redhat.com>
> ---
>  .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
> index 3bcb893d14a1..ba1f86799b7f 100644
> --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
> +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
> @@ -1058,6 +1058,9 @@ service_callback(struct vchiq_instance *instance, enum vchiq_reason reason,
>  
>  	DEBUG_TRACE(SERVICE_CALLBACK_LINE);
>  
> +	if (!instance || instance->closing)
> +		return VCHIQ_SUCCESS;
> +

How can instance ever be NULL?

And closing needs to be checked under a lock, right?

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH] staging: vchiq_arm: check vchiq_instance for NULL before dereferencing
@ 2022-06-17  9:53   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 4+ messages in thread
From: Greg Kroah-Hartman @ 2022-06-17  9:53 UTC (permalink / raw)
  To: Adrien Thierry
  Cc: Florian Fainelli, Broadcom internal kernel review list,
	Dan Carpenter, linux-rpi-kernel, linux-arm-kernel, linux-staging

On Tue, Jun 14, 2022 at 02:25:44PM -0400, Adrien Thierry wrote:
> In service_callback(), the vchiq_instance is checked for NULL after
> dereferencing it. Switch the order of those operations.
> 
> This was reported by https://lore.kernel.org/all/Yqc+Oavmh0zMRVPQ@kili/
> 
> I moved the NULL check before the call to rcu_read_lock() since access
> to the vchiq_instance is not RCU-protected (the RCU is only used to
> access the vchiq_service).
> 
> Signed-off-by: Adrien Thierry <athierry@redhat.com>
> ---
>  .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
> index 3bcb893d14a1..ba1f86799b7f 100644
> --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
> +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
> @@ -1058,6 +1058,9 @@ service_callback(struct vchiq_instance *instance, enum vchiq_reason reason,
>  
>  	DEBUG_TRACE(SERVICE_CALLBACK_LINE);
>  
> +	if (!instance || instance->closing)
> +		return VCHIQ_SUCCESS;
> +

How can instance ever be NULL?

And closing needs to be checked under a lock, right?

thanks,

greg k-h

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-06-17  9:54 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-14 18:25 [PATCH] staging: vchiq_arm: check vchiq_instance for NULL before dereferencing Adrien Thierry
2022-06-14 18:25 ` Adrien Thierry
2022-06-17  9:53 ` Greg Kroah-Hartman
2022-06-17  9:53   ` Greg Kroah-Hartman

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.