From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Alan Tull <atull@kernel.org>,
Frank Rowand <frank.rowand@sony.com>,
Guenter Roeck <linux@roeck-us.net>
Subject: [PATCH 4.20 75/80] of: overlay: add tests to validate kfrees from overlay removal
Date: Mon, 4 Feb 2019 11:37:35 +0100 [thread overview]
Message-ID: <20190204103630.360941616@linuxfoundation.org> (raw)
In-Reply-To: <20190204103620.287366543@linuxfoundation.org>
4.20-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Rowand <frank.rowand@sony.com>
commit 144552c786925314c1e7cb8f91a71dae1aca8798 upstream.
Add checks:
- attempted kfree due to refcount reaching zero before overlay
is removed
- properties linked to an overlay node when the node is removed
- node refcount > one during node removal in a changeset destroy,
if the node was created by the changeset
After applying this patch, several validation warnings will be
reported from the devicetree unittest during boot due to
pre-existing devicetree bugs. The warnings will be similar to:
OF: ERROR: of_node_release(), unexpected properties in /testcase-data/overlay-node/test-bus/test-unittest11
OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /testcase-data-2/substation@100/
hvac-medium-2
Tested-by: Alan Tull <atull@kernel.org>
Signed-off-by: Frank Rowand <frank.rowand@sony.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/dynamic.c | 29 +++++++++++++++++++++++++++++
drivers/of/overlay.c | 1 +
include/linux/of.h | 15 ++++++++++-----
3 files changed, 40 insertions(+), 5 deletions(-)
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -333,6 +333,25 @@ void of_node_release(struct kobject *kob
if (!of_node_check_flag(node, OF_DYNAMIC))
return;
+ if (of_node_check_flag(node, OF_OVERLAY)) {
+
+ if (!of_node_check_flag(node, OF_OVERLAY_FREE_CSET)) {
+ /* premature refcount of zero, do not free memory */
+ pr_err("ERROR: memory leak before free overlay changeset, %pOF\n",
+ node);
+ return;
+ }
+
+ /*
+ * If node->properties non-empty then properties were added
+ * to this node either by different overlay that has not
+ * yet been removed, or by a non-overlay mechanism.
+ */
+ if (node->properties)
+ pr_err("ERROR: %s(), unexpected properties in %pOF\n",
+ __func__, node);
+ }
+
property_list_free(node->properties);
property_list_free(node->deadprops);
@@ -437,6 +456,16 @@ struct device_node *__of_node_dup(const
static void __of_changeset_entry_destroy(struct of_changeset_entry *ce)
{
+ if (ce->action == OF_RECONFIG_ATTACH_NODE &&
+ of_node_check_flag(ce->np, OF_OVERLAY)) {
+ if (kref_read(&ce->np->kobj.kref) > 1) {
+ pr_err("ERROR: memory leak, expected refcount 1 instead of %d, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node %pOF\n",
+ kref_read(&ce->np->kobj.kref), ce->np);
+ } else {
+ of_node_set_flag(ce->np, OF_OVERLAY_FREE_CSET);
+ }
+ }
+
of_node_put(ce->np);
list_del(&ce->node);
kfree(ce);
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -373,6 +373,7 @@ static int add_changeset_node(struct ove
return -ENOMEM;
tchild->parent = target_node;
+ of_node_set_flag(tchild, OF_OVERLAY);
ret = of_changeset_attach_node(&ovcs->cset, tchild);
if (ret)
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -138,11 +138,16 @@ extern struct device_node *of_aliases;
extern struct device_node *of_stdout;
extern raw_spinlock_t devtree_lock;
-/* flag descriptions (need to be visible even when !CONFIG_OF) */
-#define OF_DYNAMIC 1 /* node and properties were allocated via kmalloc */
-#define OF_DETACHED 2 /* node has been detached from the device tree */
-#define OF_POPULATED 3 /* device already created for the node */
-#define OF_POPULATED_BUS 4 /* of_platform_populate recursed to children of this node */
+/*
+ * struct device_node flag descriptions
+ * (need to be visible even when !CONFIG_OF)
+ */
+#define OF_DYNAMIC 1 /* (and properties) allocated via kmalloc */
+#define OF_DETACHED 2 /* detached from the device tree */
+#define OF_POPULATED 3 /* device already created */
+#define OF_POPULATED_BUS 4 /* platform bus created for children */
+#define OF_OVERLAY 5 /* allocated for an overlay */
+#define OF_OVERLAY_FREE_CSET 6 /* in overlay cset being freed */
#define OF_BAD_ADDR ((u64)-1)
next prev parent reply other threads:[~2019-02-04 10:54 UTC|newest]
Thread overview: 84+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-04 10:36 [PATCH 4.20 00/80] 4.20.7-stable review Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 01/80] drm/msm/gpu: fix building without debugfs Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 02/80] ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 03/80] ipvlan, l3mdev: fix broken l3s mode wrt local routes Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 04/80] l2tp: copy 4 more bytes to linear part if necessary Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 05/80] l2tp: fix reading optional fields of L2TPv3 Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 06/80] net: ip_gre: always reports o_key to userspace Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 07/80] net: ip_gre: use erspan key field for tunnel lookup Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 08/80] net/ipv6: dont return positive numbers when nothing was dumped Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 09/80] net/mlx4_core: Add masking for a few queries on HCA caps Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 10/80] netrom: switch to sock timer API Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 11/80] net/rose: fix NULL ax25_cb kernel panic Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 12/80] net: set default network namespace in init_dummy_netdev() Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 13/80] ravb: expand rx descriptor data to accommodate hw checksum Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 14/80] sctp: improve the events for sctp stream reset Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 15/80] tun: move the call to tun_set_real_num_queues Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 16/80] ucc_geth: Reset BQL queue when stopping device Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 17/80] vhost: fix OOB in get_rx_bufs() Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 18/80] net: ip6_gre: always reports o_key to userspace Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 19/80] sctp: improve the events for sctp stream adding Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 20/80] net/mlx5e: Allow MAC invalidation while spoofchk is ON Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 21/80] ip6mr: Fix notifiers call on mroute_clean_tables() Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 22/80] Revert "net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager" Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 23/80] sctp: set chunk transport correctly when its a new asoc Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 24/80] sctp: set flow sport from saddr only when its 0 Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 25/80] net: tls: Fix deadlock in free_resources tx Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 26/80] net: tls: Save iv in tls_rec for async crypto requests Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 27/80] virtio_net: Dont enable NAPI when interface is down Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 28/80] virtio_net: Dont call free_old_xmit_skbs for xdp_frames Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 29/80] virtio_net: Fix not restoring real_num_rx_queues Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 30/80] virtio_net: Fix out of bounds access of sq Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 31/80] virtio_net: Dont process redirected XDP frames when XDP is disabled Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 32/80] virtio_net: Use xdp_return_frame to free xdp_frames on destroying vqs Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 33/80] virtio_net: Differentiate sk_buff and xdp_frame on freeing Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 34/80] ipv6: Consider sk_bound_dev_if when binding a socket to an address Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 35/80] CIFS: Do not count -ENODATA as failure for query directory Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 36/80] CIFS: Fix possible oops and memory leaks in async IO Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 37/80] CIFS: Fix trace command logging for SMB2 reads and writes Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 38/80] CIFS: fix use-after-free of the lease keys Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 39/80] CIFS: Do not consider -ENODATA as stat failure for reads Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 40/80] fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb() Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 41/80] iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions() Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 42/80] selftests/seccomp: Enhance per-arch ptrace syscall skip tests Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 43/80] NFS: Fix up return value on fatal errors in nfs_page_async_flush() Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 44/80] ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 45/80] arm64: kaslr: ensure randomized quantities are clean also when kaslr is off Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 46/80] arm64: Do not issue IPIs for user executable ptes Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 47/80] arm64: hyp-stub: Forbid kprobing of the hyp-stub Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 48/80] arm64: hibernate: Clean the __hyp_text to PoC after resume Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 49/80] gpio: altera-a10sr: Set proper output level for direction_output Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 50/80] gpiolib: fix line event timestamps for nested irqs Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 51/80] gpio: pcf857x: Fix interrupts on multiple instances Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 52/80] gpio: sprd: Fix the incorrect data register Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 53/80] gpio: sprd: Fix incorrect irq type setting for the async EIC Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 54/80] gfs2: Revert "Fix loop in gfs2_rbm_find" Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 55/80] mmc: bcm2835: Fix DMA channel leak on probe error Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 56/80] mmc: mediatek: fix incorrect register setting of hs400_cmd_int_delay Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 57/80] ALSA: usb-audio: Add Opus #3 to quirks for native DSD support Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 58/80] ALSA: hda/realtek - Fixed hp_pin no value Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 59/80] ALSA: pcm: Fix tight loop of OSS capture stream Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 60/80] IB/uverbs: Fix OOPs upon device disassociation Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 61/80] IB/uverbs: Fix OOPs in uverbs_user_mmap_disassociate Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 62/80] IB/hfi1: Remove overly conservative VM_EXEC flag check Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 63/80] IB/hfi1: Add limit test for RC/UC send via loopback Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 64/80] platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 65/80] platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 66/80] Btrfs: fix deadlock when allocating tree block during leaf/node split Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 67/80] btrfs: On error always free subvol_name in btrfs_mount Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 68/80] kernel/exit.c: release ptraced tasks before zap_pid_ns_processes Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 69/80] mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 70/80] oom, oom_reaper: do not enqueue same task twice Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 71/80] mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 72/80] mm, oom: fix use-after-free in oom_kill_process Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 73/80] mm: hwpoison: use do_send_sig_info() instead of force_sig() Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 74/80] mm: migrate: dont rely on __PageMovable() of newpage after unlocking it Greg Kroah-Hartman
2019-02-04 10:37 ` Greg Kroah-Hartman [this message]
2019-02-04 10:37 ` [PATCH 4.20 76/80] of: overlay: add missing of_node_get() in __of_attach_node_sysfs Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 77/80] of: overlay: use prop add changeset entry for property in new nodes Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 78/80] of: overlay: do not duplicate properties from overlay for " Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 79/80] md/raid5: fix out of memory during raid cache recovery Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 80/80] cifs: Always resolve hostname before reconnecting Greg Kroah-Hartman
2019-02-04 21:49 ` [PATCH 4.20 00/80] 4.20.7-stable review Guenter Roeck
2019-02-05 6:20 ` Naresh Kamboju
2019-02-05 14:43 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190204103630.360941616@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=atull@kernel.org \
--cc=frank.rowand@sony.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).