* [PATCH v2] gpio: mvebu: fix potential user-after-free on probe
@ 2020-11-30 15:09 Baruch Siach
2020-11-30 15:30 ` Uwe Kleine-König
0 siblings, 1 reply; 3+ messages in thread
From: Baruch Siach @ 2020-11-30 15:09 UTC (permalink / raw)
To: Thierry Reding, Uwe Kleine-König, Lee Jones, Linus Walleij,
Bartosz Golaszewski
Cc: Andrew Lunn, Baruch Siach, linux-pwm, Gregory Clement,
linux-gpio, Chris Packham, Thomas Petazzoni, Ralph Sennhauser,
Sascha Hauer, linux-arm-kernel, Sebastian Hesselbarth
When mvebu_pwm_probe() fails IRQ domain is not released. Goto the
err_domain label on failure to release IRQ domain.
Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
Reported-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
v2: Don't leak pwm resources (Uwe Kleine-König)
This is split out of the "gpio: mvebu: Armada 8K/7K PWM support" series.
I'll rebase the series v2 on top on this fix.
---
drivers/gpio/gpio-mvebu.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 433e2c3f3fd5..c53ed975a180 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -1255,8 +1255,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
}
/* Some MVEBU SoCs have simple PWM support for GPIO lines */
- if (IS_ENABLED(CONFIG_PWM))
- return mvebu_pwm_probe(pdev, mvchip, id);
+ if (IS_ENABLED(CONFIG_PWM)) {
+ err = mvebu_pwm_probe(pdev, mvchip, id);
+ if (err)
+ goto err_domain;
+ }
return 0;
--
2.29.2
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] gpio: mvebu: fix potential user-after-free on probe
2020-11-30 15:09 [PATCH v2] gpio: mvebu: fix potential user-after-free on probe Baruch Siach
@ 2020-11-30 15:30 ` Uwe Kleine-König
2020-11-30 18:12 ` Baruch Siach
0 siblings, 1 reply; 3+ messages in thread
From: Uwe Kleine-König @ 2020-11-30 15:30 UTC (permalink / raw)
To: Baruch Siach
Cc: Andrew Lunn, Sascha Hauer, linux-pwm, Linus Walleij,
Chris Packham, Bartosz Golaszewski, Thierry Reding,
Thomas Petazzoni, linux-gpio, Ralph Sennhauser, Lee Jones,
Gregory Clement, linux-arm-kernel, Sebastian Hesselbarth
[-- Attachment #1.1: Type: text/plain, Size: 1469 bytes --]
On Mon, Nov 30, 2020 at 05:09:53PM +0200, Baruch Siach wrote:
> When mvebu_pwm_probe() fails IRQ domain is not released. Goto the
> err_domain label on failure to release IRQ domain.
>
> Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
> Reported-by: Andrew Lunn <andrew@lunn.ch>
> Signed-off-by: Baruch Siach <baruch@tkos.co.il>
> ---
> v2: Don't leak pwm resources (Uwe Kleine-König)
>
> This is split out of the "gpio: mvebu: Armada 8K/7K PWM support" series.
> I'll rebase the series v2 on top on this fix.
> ---
> drivers/gpio/gpio-mvebu.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
> index 433e2c3f3fd5..c53ed975a180 100644
> --- a/drivers/gpio/gpio-mvebu.c
> +++ b/drivers/gpio/gpio-mvebu.c
> @@ -1255,8 +1255,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
> }
>
> /* Some MVEBU SoCs have simple PWM support for GPIO lines */
> - if (IS_ENABLED(CONFIG_PWM))
> - return mvebu_pwm_probe(pdev, mvchip, id);
> + if (IS_ENABLED(CONFIG_PWM)) {
> + err = mvebu_pwm_probe(pdev, mvchip, id);
> + if (err)
> + goto err_domain;
I only looked quickly, but I wonder if you need to undo
irq_alloc_domain_generic_chips(), too?!
Best regards
Uwe
--
Pengutronix e.K. | Uwe Kleine-König |
Industrial Linux Solutions | https://www.pengutronix.de/ |
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
[-- Attachment #2: Type: text/plain, Size: 176 bytes --]
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] gpio: mvebu: fix potential user-after-free on probe
2020-11-30 15:30 ` Uwe Kleine-König
@ 2020-11-30 18:12 ` Baruch Siach
0 siblings, 0 replies; 3+ messages in thread
From: Baruch Siach @ 2020-11-30 18:12 UTC (permalink / raw)
To: Uwe Kleine-König, Thomas Gleixner
Cc: Andrew Lunn, Sascha Hauer, linux-pwm, Linus Walleij,
Chris Packham, Bartosz Golaszewski, Thierry Reding,
Thomas Petazzoni, linux-gpio, Ralph Sennhauser, Lee Jones,
Gregory Clement, linux-arm-kernel, Sebastian Hesselbarth
Hi Uwe,
(+ tglx)
On Mon, Nov 30 2020, Uwe Kleine-König wrote:
> On Mon, Nov 30, 2020 at 05:09:53PM +0200, Baruch Siach wrote:
>> When mvebu_pwm_probe() fails IRQ domain is not released. Goto the
>> err_domain label on failure to release IRQ domain.
>>
>> Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support")
>> Reported-by: Andrew Lunn <andrew@lunn.ch>
>> Signed-off-by: Baruch Siach <baruch@tkos.co.il>
>> ---
>> v2: Don't leak pwm resources (Uwe Kleine-König)
>>
>> This is split out of the "gpio: mvebu: Armada 8K/7K PWM support" series.
>> I'll rebase the series v2 on top on this fix.
>> ---
>> drivers/gpio/gpio-mvebu.c | 7 +++++--
>> 1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
>> index 433e2c3f3fd5..c53ed975a180 100644
>> --- a/drivers/gpio/gpio-mvebu.c
>> +++ b/drivers/gpio/gpio-mvebu.c
>> @@ -1255,8 +1255,11 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
>> }
>>
>> /* Some MVEBU SoCs have simple PWM support for GPIO lines */
>> - if (IS_ENABLED(CONFIG_PWM))
>> - return mvebu_pwm_probe(pdev, mvchip, id);
>> + if (IS_ENABLED(CONFIG_PWM)) {
>> + err = mvebu_pwm_probe(pdev, mvchip, id);
>> + if (err)
>> + goto err_domain;
>
> I only looked quickly, but I wonder if you need to undo
> irq_alloc_domain_generic_chips(), too?!
So it seems. __irq_alloc_domain_generic_chips() calls kzalloc() for the
gc field of irq_domain. But I could not find any code that releases this
allocation. These drivers call irq_alloc_domain_generic_chips(), but do
not release gc on failure:
drivers/irqchip/irq-ingenic-tcu.c
drivers/irqchip/irq-orion.c
drivers/irqchip/irq-renesas-irqc.c
drivers/irqchip/irq-sunxi-nmi.c
drivers/pinctrl/pinctrl-rockchip.c
Some of them apparently skip the cleanup because the system would be
unusable anyway. But most of them call irq_domain_remove() on failure.
Thomas, what is the right thing to do here? Should we just call
kfree(mvchip->domain->gc);
directly to release the allocation?
Thanks,
baruch
--
~. .~ Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
- baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-11-30 18:14 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-30 15:09 [PATCH v2] gpio: mvebu: fix potential user-after-free on probe Baruch Siach
2020-11-30 15:30 ` Uwe Kleine-König
2020-11-30 18:12 ` Baruch Siach
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).