[PATCH v2] staging: pi433: fix race condition in pi433_open

[PATCH v2] staging: pi433: fix race condition in pi433_open

[Hugo Lefeuvre]

The device structure contains a useless non-atomic users counter which
is subject to race conditions. It has probably been created to handle
the case where remove is executed while operations are still executing
on open fds but this will never happen because of reference counts.

Drop the users counter and move rx buffer {de,}allocation to probe()
and remove(). Remove associated dead code from open() and release().
Remove related TODO entry from ioctl().

Signed-off-by: Hugo Lefeuvre <hle@owl.eu.com>
---
Changes in v2:
    - Remove useless users counter.
    - Remove unneeded TODO entry in ioctl().
    - Move rx buffer {de,}allocation to probe() and remove().
---
diff --git a/drivers/staging/pi433/pi433_if.c b/drivers/staging/pi433/pi433_if.c
index 94e0bfcec991..a5aa9c5bc6fd 100644
--- a/drivers/staging/pi433/pi433_if.c
+++ b/drivers/staging/pi433/pi433_if.c
@@ -78,7 +78,6 @@ struct pi433_device {
 	struct device		*dev;
 	struct cdev		*cdev;
 	struct spi_device	*spi;
-	unsigned int		users;
 
 	/* irq related values */
 	struct gpio_desc	*gpiod[NUM_DIO];
@@ -887,9 +886,6 @@ pi433_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	if (_IOC_TYPE(cmd) != PI433_IOC_MAGIC)
 		return -ENOTTY;
 
-	/* TODO? guard against device removal before, or while,
-	 * we issue this ioctl. --> device_get()
-	 */
 	instance = filp->private_data;
 	device = instance->device;
 
@@ -963,19 +959,9 @@ static int pi433_open(struct inode *inode, struct file *filp)
 		return -ENODEV;
 	}
 
-	if (!device->rx_buffer) {
-		device->rx_buffer = kmalloc(MAX_MSG_SIZE, GFP_KERNEL);
-		if (!device->rx_buffer)
-			return -ENOMEM;
-	}
-
-	device->users++;
 	instance = kzalloc(sizeof(*instance), GFP_KERNEL);
-	if (!instance) {
-		kfree(device->rx_buffer);
-		device->rx_buffer = NULL;
+	if (!instance)
 		return -ENOMEM;
-	}
 
 	/* setup instance data*/
 	instance->device = device;
@@ -992,23 +978,11 @@ static int pi433_open(struct inode *inode, struct file *filp)
 static int pi433_release(struct inode *inode, struct file *filp)
 {
 	struct pi433_instance	*instance;
-	struct pi433_device	*device;
 
 	instance = filp->private_data;
-	device = instance->device;
 	kfree(instance);
 	filp->private_data = NULL;
 
-	/* last close? */
-	device->users--;
-
-	if (!device->users) {
-		kfree(device->rx_buffer);
-		device->rx_buffer = NULL;
-		if (!device->spi)
-			kfree(device);
-	}
-
 	return 0;
 }
 
@@ -1178,6 +1152,11 @@ static int pi433_probe(struct spi_device *spi)
 	device->tx_active = false;
 	device->interrupt_rx_allowed = false;
 
+	/* init rx buffer */
+	device->rx_buffer = kmalloc(MAX_MSG_SIZE, GFP_KERNEL);
+	if (!device->rx_buffer)
+		return -ENOMEM;
+
 	/* init wait queues */
 	init_waitqueue_head(&device->tx_wait_queue);
 	init_waitqueue_head(&device->rx_wait_queue);
@@ -1280,6 +1259,7 @@ static int pi433_probe(struct spi_device *spi)
 minor_failed:
 	free_gpio(device);
 GPIO_failed:
+	kfree(device->rx_buffer);
 	kfree(device);
 
 	return retval;
@@ -1303,8 +1283,8 @@ static int pi433_remove(struct spi_device *spi)
 
 	pi433_free_minor(device);
 
-	if (device->users == 0)
-		kfree(device);
+	kfree(device->rx_buffer);
+	kfree(device);
 
 	return 0;
 }
-- 
2.17.1

Re: [PATCH v2] staging: pi433: fix race condition in pi433_open

[Dan Carpenter]

On Tue, Jun 19, 2018 at 10:33:26PM -0400, Hugo Lefeuvre wrote:
> @@ -1178,6 +1152,11 @@ static int pi433_probe(struct spi_device *spi)
>  	device->tx_active = false;
>  	device->interrupt_rx_allowed = false;
>  
> +	/* init rx buffer */
> +	device->rx_buffer = kmalloc(MAX_MSG_SIZE, GFP_KERNEL);
> +	if (!device->rx_buffer)
> +		return -ENOMEM;

We need to free device.

> +
>  	/* init wait queues */
>  	init_waitqueue_head(&device->tx_wait_queue);
>  	init_waitqueue_head(&device->rx_wait_queue);
> @@ -1280,6 +1259,7 @@ static int pi433_probe(struct spi_device *spi)
>  minor_failed:
>  	free_gpio(device);
>  GPIO_failed:
> +	kfree(device->rx_buffer);
>  	kfree(device);
>  
>  	return retval;

regards,
dan carpenter

Re: [PATCH v2] staging: pi433: fix race condition in pi433_open

[Hugo Lefeuvre]

[-- Attachment #1: Type: text/plain, Size: 632 bytes --]

On Wed, Jun 20, 2018 at 11:34:39AM +0300, Dan Carpenter wrote:
> On Tue, Jun 19, 2018 at 10:33:26PM -0400, Hugo Lefeuvre wrote:
> > @@ -1178,6 +1152,11 @@ static int pi433_probe(struct spi_device *spi)
> >  	device->tx_active = false;
> >  	device->interrupt_rx_allowed = false;
> >  
> > +	/* init rx buffer */
> > +	device->rx_buffer = kmalloc(MAX_MSG_SIZE, GFP_KERNEL);
> > +	if (!device->rx_buffer)
> > +		return -ENOMEM;
> 
> We need to free device.

Fixed in v3. Thanks !

regards,
 Hugo

-- 
             Hugo Lefeuvre (hle)    |    www.owl.eu.com
4096/ 9C4F C8BF A4B0 8FC5 48EB 56B8 1962 765B B9A8 BACA

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]