From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B742C433F5 for ; Thu, 6 Jan 2022 18:36:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242928AbiAFSgF (ORCPT ); Thu, 6 Jan 2022 13:36:05 -0500 Received: from smtp02.smtpout.orange.fr ([80.12.242.124]:52079 "EHLO smtp.smtpout.orange.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242731AbiAFSgE (ORCPT ); Thu, 6 Jan 2022 13:36:04 -0500 Received: from [192.168.1.18] ([90.11.185.88]) by smtp.orange.fr with ESMTPA id 5XcCn6oLyBazo5XcDn2y4b; Thu, 06 Jan 2022 19:36:03 +0100 X-ME-Helo: [192.168.1.18] X-ME-Auth: YWZlNiIxYWMyZDliZWIzOTcwYTEyYzlhMmU3ZiQ1M2U2MzfzZDfyZTMxZTBkMTYyNDBjNDJlZmQ3ZQ== X-ME-Date: Thu, 06 Jan 2022 19:36:03 +0100 X-ME-IP: 90.11.185.88 Message-ID: Date: Thu, 6 Jan 2022 19:35:56 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.3.1 Subject: Re: [PATCH] fsi: Aspeed: Fix a potential double free Content-Language: en-US To: Guenter Roeck , Dan Carpenter , Greg KH Cc: kernel-janitors@vger.kernel.org, linux-aspeed@lists.ozlabs.org, alistair@popple.id.au, linux-kernel@vger.kernel.org, linux-fsi@lists.ozlabs.org, linux-arm-kernel@lists.infradead.org References: <2cafa0607ca171ebd00ac6c7e073b46808e24f00.1640537669.git.christophe.jaillet@wanadoo.fr> <20220106081418.GH7674@kadam> From: Christophe JAILLET In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Le 06/01/2022 à 18:25, Guenter Roeck a écrit : > On 1/6/22 12:14 AM, Dan Carpenter wrote: >> On Mon, Dec 27, 2021 at 07:29:07AM +0100, Greg KH wrote: >>> On Sun, Dec 26, 2021 at 05:56:02PM +0100, Christophe JAILLET wrote: >>>> 'aspeed' is a devm_alloc'ed, so there is no need to free it >>>> explicitly or >>>> there will be a double free(). >>> >>> A struct device can never be devm_alloced for obvious reasons.  Perhaps >>> that is the real problem here? >>> >> >> I don't understand how "aspeed" is a struct device. >> > > -static void aspeed_master_release(struct device *dev) > -{ > -    struct fsi_master_aspeed *aspeed = > -        to_fsi_master_aspeed(dev_to_fsi_master(dev)); > - > -    kfree(aspeed); > -} > > So "dev" is embedded in struct fsi_master, and struct fsi_master is > embedded > in struct fsi_master_aspeed. Since "struct device" is embedded, the data > structure embedding it must be released with the release function, as is > done > here. The problem is indeed that the data structure is allocated with > devm_kzalloc(), which as Greg points out must not be devm_ allocated > (because its lifetime does not match the lifetime of devm_ allocated > memory). Thanks a lot for the detailed explanation. Crystal clear for me now. Do you want me to send a patch to remove the devm_ or will you? CJ > >> I've been working on understanding device managed memory recently for >> Smatch.  It's really complicated.  There are a bunch of rules/heuristics >> that I'm slowly creating to generate new warnings but I'm a long way >> from understanding it well myself. >> > > A data structure embedding struct device must not be devm_ allocated, > and it must be released with the release callback. Maybe there is > a means to flag that somehow ? > > Guenter > From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 57557C433EF for ; Thu, 6 Jan 2022 18:38:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:From:References:Cc:To:Subject: MIME-Version:Date:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=etcn92rX01xr43Tg/ZYue/p6EfTHAya5OuxvJtqn3MU=; b=xFty7Nd5n4Q4Z9 q/en9Gc8PgxJYlMZq3hotP4BcPSuh50SGNM9TgwxG61RoCWUvSjNNRxy5OZCdAewriX1wCw4GFAKB 8gp3ScusoJ3kBbpritWNdnK4oO4PtlZVrewm0ZPxG4KGrVhMVl6ZM5L/FtVnksvlhufrz2hZVZQQH us8QtFATWnSLOjHZ2nx9b3ndwgYbM0RqCd6EhrwoAEtmEGzOiwuJPNNst6SFQRC3ftCFpDnWe9bz9 lTSaj4oRiGmJS1IzOW0Bpy4xs2jz/lf+OuScMMjz1/n9SACF5t6+nVY/DxfExkbb29DH5SPejEeQ/ C1dsD1+0Cd/UdjBBwfdw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1n5Xcc-0014Zv-Cd; Thu, 06 Jan 2022 18:36:22 +0000 Received: from smtp02.smtpout.orange.fr ([80.12.242.124] helo=smtp.smtpout.orange.fr) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1n5XcY-0014Vf-Le for linux-arm-kernel@lists.infradead.org; Thu, 06 Jan 2022 18:36:20 +0000 Received: from [192.168.1.18] ([90.11.185.88]) by smtp.orange.fr with ESMTPA id 5XcCn6oLyBazo5XcDn2y4b; Thu, 06 Jan 2022 19:36:03 +0100 X-ME-Helo: [192.168.1.18] X-ME-Auth: YWZlNiIxYWMyZDliZWIzOTcwYTEyYzlhMmU3ZiQ1M2U2MzfzZDfyZTMxZTBkMTYyNDBjNDJlZmQ3ZQ== X-ME-Date: Thu, 06 Jan 2022 19:36:03 +0100 X-ME-IP: 90.11.185.88 Message-ID: Date: Thu, 6 Jan 2022 19:35:56 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.3.1 Subject: Re: [PATCH] fsi: Aspeed: Fix a potential double free Content-Language: en-US To: Guenter Roeck , Dan Carpenter , Greg KH Cc: kernel-janitors@vger.kernel.org, linux-aspeed@lists.ozlabs.org, alistair@popple.id.au, linux-kernel@vger.kernel.org, linux-fsi@lists.ozlabs.org, linux-arm-kernel@lists.infradead.org References: <2cafa0607ca171ebd00ac6c7e073b46808e24f00.1640537669.git.christophe.jaillet@wanadoo.fr> <20220106081418.GH7674@kadam> From: Christophe JAILLET In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220106_103618_898110_868E504B X-CRM114-Status: GOOD ( 21.03 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org TGUgMDYvMDEvMjAyMiDDoCAxODoyNSwgR3VlbnRlciBSb2VjayBhIMOpY3JpdMKgOgo+IE9uIDEv Ni8yMiAxMjoxNCBBTSwgRGFuIENhcnBlbnRlciB3cm90ZToKPj4gT24gTW9uLCBEZWMgMjcsIDIw MjEgYXQgMDc6Mjk6MDdBTSArMDEwMCwgR3JlZyBLSCB3cm90ZToKPj4+IE9uIFN1biwgRGVjIDI2 LCAyMDIxIGF0IDA1OjU2OjAyUE0gKzAxMDAsIENocmlzdG9waGUgSkFJTExFVCB3cm90ZToKPj4+ PiAnYXNwZWVkJyBpcyBhIGRldm1fYWxsb2MnZWQsIHNvIHRoZXJlIGlzIG5vIG5lZWQgdG8gZnJl ZSBpdCAKPj4+PiBleHBsaWNpdGx5IG9yCj4+Pj4gdGhlcmUgd2lsbCBiZSBhIGRvdWJsZSBmcmVl KCkuCj4+Pgo+Pj4gQSBzdHJ1Y3QgZGV2aWNlIGNhbiBuZXZlciBiZSBkZXZtX2FsbG9jZWQgZm9y IG9idmlvdXMgcmVhc29ucy7CoCBQZXJoYXBzCj4+PiB0aGF0IGlzIHRoZSByZWFsIHByb2JsZW0g aGVyZT8KPj4+Cj4+Cj4+IEkgZG9uJ3QgdW5kZXJzdGFuZCBob3cgImFzcGVlZCIgaXMgYSBzdHJ1 Y3QgZGV2aWNlLgo+Pgo+IAo+IC1zdGF0aWMgdm9pZCBhc3BlZWRfbWFzdGVyX3JlbGVhc2Uoc3Ry dWN0IGRldmljZSAqZGV2KQo+IC17Cj4gLcKgwqDCoCBzdHJ1Y3QgZnNpX21hc3Rlcl9hc3BlZWQg KmFzcGVlZCA9Cj4gLcKgwqDCoMKgwqDCoMKgIHRvX2ZzaV9tYXN0ZXJfYXNwZWVkKGRldl90b19m c2lfbWFzdGVyKGRldikpOwo+IC0KPiAtwqDCoMKgIGtmcmVlKGFzcGVlZCk7Cj4gLX0KPiAKPiBT byAiZGV2IiBpcyBlbWJlZGRlZCBpbiBzdHJ1Y3QgZnNpX21hc3RlciwgYW5kIHN0cnVjdCBmc2lf bWFzdGVyIGlzIAo+IGVtYmVkZGVkCj4gaW4gc3RydWN0IGZzaV9tYXN0ZXJfYXNwZWVkLiBTaW5j ZSAic3RydWN0IGRldmljZSIgaXMgZW1iZWRkZWQsIHRoZSBkYXRhCj4gc3RydWN0dXJlIGVtYmVk ZGluZyBpdCBtdXN0IGJlIHJlbGVhc2VkIHdpdGggdGhlIHJlbGVhc2UgZnVuY3Rpb24sIGFzIGlz IAo+IGRvbmUKPiBoZXJlLiBUaGUgcHJvYmxlbSBpcyBpbmRlZWQgdGhhdCB0aGUgZGF0YSBzdHJ1 Y3R1cmUgaXMgYWxsb2NhdGVkIHdpdGgKPiBkZXZtX2t6YWxsb2MoKSwgd2hpY2ggYXMgR3JlZyBw b2ludHMgb3V0IG11c3Qgbm90IGJlIGRldm1fIGFsbG9jYXRlZAo+IChiZWNhdXNlIGl0cyBsaWZl dGltZSBkb2VzIG5vdCBtYXRjaCB0aGUgbGlmZXRpbWUgb2YgZGV2bV8gYWxsb2NhdGVkCj4gbWVt b3J5KS4KClRoYW5rcyBhIGxvdCBmb3IgdGhlIGRldGFpbGVkIGV4cGxhbmF0aW9uLgpDcnlzdGFs IGNsZWFyIGZvciBtZSBub3cuCgpEbyB5b3Ugd2FudCBtZSB0byBzZW5kIGEgcGF0Y2ggdG8gcmVt b3ZlIHRoZSBkZXZtXyBvciB3aWxsIHlvdT8KCkNKCgo+IAo+PiBJJ3ZlIGJlZW4gd29ya2luZyBv biB1bmRlcnN0YW5kaW5nIGRldmljZSBtYW5hZ2VkIG1lbW9yeSByZWNlbnRseSBmb3IKPj4gU21h dGNoLsKgIEl0J3MgcmVhbGx5IGNvbXBsaWNhdGVkLsKgIFRoZXJlIGFyZSBhIGJ1bmNoIG9mIHJ1 bGVzL2hldXJpc3RpY3MKPj4gdGhhdCBJJ20gc2xvd2x5IGNyZWF0aW5nIHRvIGdlbmVyYXRlIG5l dyB3YXJuaW5ncyBidXQgSSdtIGEgbG9uZyB3YXkKPj4gZnJvbSB1bmRlcnN0YW5kaW5nIGl0IHdl bGwgbXlzZWxmLgo+Pgo+IAo+IEEgZGF0YSBzdHJ1Y3R1cmUgZW1iZWRkaW5nIHN0cnVjdCBkZXZp Y2UgbXVzdCBub3QgYmUgZGV2bV8gYWxsb2NhdGVkLAo+IGFuZCBpdCBtdXN0IGJlIHJlbGVhc2Vk IHdpdGggdGhlIHJlbGVhc2UgY2FsbGJhY2suIE1heWJlIHRoZXJlIGlzCj4gYSBtZWFucyB0byBm bGFnIHRoYXQgc29tZWhvdyA/Cj4gCj4gR3VlbnRlcgo+IAoKCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCmxpbnV4LWFybS1rZXJuZWwgbWFpbGluZyBsaXN0 CmxpbnV4LWFybS1rZXJuZWxAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFk ZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LWFybS1rZXJuZWwK