From: Frank Rowand <frowand.list@gmail.com>
To: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>,
Pantelis Antoniou <pantelis.antoniou@konsulko.com>,
Rob Herring <robh+dt@kernel.org>,
Colin King <colin.king@canonical.com>,
Dan Carpenter <dan.carpenter@oracle.com>,
"devicetree@vger.kernel.org" <devicetree@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v2 1/2] of: overlay: Fix memory leak in of_overlay_apply() error path
Date: Tue, 5 Dec 2017 08:46:16 -0500 [thread overview]
Message-ID: <64cf7e5d-176e-cae0-fd12-93825f2f14a2@gmail.com> (raw)
In-Reply-To: <CAMuHMdV20VAw4Dz6z9quDhm3=ZRotB+Y302i8gTnG0B8shFwOA@mail.gmail.com>
On 12/05/17 05:49, Geert Uytterhoeven wrote:
> Hi Frank,
>
> On Tue, Dec 5, 2017 at 9:01 AM, Geert Uytterhoeven <geert@linux-m68k.org> wrote:
>> On Tue, Dec 5, 2017 at 3:07 AM, Frank Rowand <frowand.list@gmail.com> wrote:
>>> On 12/04/17 10:47, Geert Uytterhoeven wrote:
>>>> If of_resolve_phandles() fails, free_overlay_changeset() is called in
>>>> the error path. However, that function returns early if the list hasn't
>>>> been initialized yet, before freeing the object.
>>>>
>>>> Explicitly calling kfree() instead would solve that issue. However, that
>>>> complicates matter, by having to consider which of two different methods
>>>> to use to dispose of the same object.
>>>>
>>>> Hence make free_overlay_changeset() consider initialization state of the
>>>> different parts of the object, making it always safe to call (once!) to
>>>> dispose of a (partially) initialized overlay_changeset:
>>>> - Only destroy the changeset if the list was initialized,
>>>> - Ignore uninitialized IDs (zero).
>>>>
>>>> Reported-by: Colin King <colin.king@canonical.com>
>>>> Fixes: f948d6d8b792bb90 ("of: overlay: avoid race condition between applying multiple overlays")
>>>> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
>>>> ---
>>>> drivers/of/overlay.c | 7 +++----
>>>> 1 file changed, 3 insertions(+), 4 deletions(-)
>>>>
>>>> diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
>>>> index 3b7a3980ff50d6bf..312cd658bec0083b 100644
>>>> --- a/drivers/of/overlay.c
>>>> +++ b/drivers/of/overlay.c
>>>> @@ -630,11 +630,10 @@ static void free_overlay_changeset(struct overlay_changeset *ovcs)
>>>> {
>>>> int i;
>>>>
>>>> - if (!ovcs->cset.entries.next)
>>>> - return;
>>>> - of_changeset_destroy(&ovcs->cset);
>>>> + if (ovcs->cset.entries.next)
>>>> + of_changeset_destroy(&ovcs->cset);
>>>>
>>>
>>> OK
>>>
>>>> - if (ovcs->id)
>>>> + if (ovcs->id > 0)
>>>
>>> Instead of this change, could you please make a change in init_overlay_changeset()?
>>>
>>> Current init_overlay_changeset():
>>>
>>> ovcs->id = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL);
>>> if (ovcs->id <= 0)
>>> return ovcs->id;
>>>
>>> My proposed version:
>>>
>>> ret = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL);
>>> if (ret <= 0)
>>> return ret;
>>> ovcs->id = ret;
>>
>> Sure.
>
> Actually we should use a temporary variable id here, just like for cnt
> and fragments, and store into ovcs->id if everything succeeds.
OK. That would make the flow in init_overlay_changeset() more consistent.
And of course the idr_remove() after err_free_idr: would use that temporary
variable id.
> Else both init_overlay_changeset() and free_overlay_changeset() will
> free the ID if something goes wrong. It seems IDR can handle that, but
> better safe than sorry.>
> Gr{oetje,eeting}s,
>
> Geert
>
> --
> Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
>
> In personal conversations with technical people, I call myself a hacker. But
> when I'm talking to journalists I just say "programmer" or something like that.
> -- Linus Torvalds
>
next prev parent reply other threads:[~2017-12-05 13:46 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-04 15:47 [PATCH v2 0/2] of: overlay: Fix of_overlay_apply() error path Geert Uytterhoeven
2017-12-04 15:47 ` [PATCH v2 1/2] of: overlay: Fix memory leak in " Geert Uytterhoeven
2017-12-05 2:07 ` Frank Rowand
2017-12-05 8:01 ` Geert Uytterhoeven
2017-12-05 10:49 ` Geert Uytterhoeven
2017-12-05 13:46 ` Frank Rowand [this message]
2017-12-05 13:45 ` Frank Rowand
2017-12-05 13:58 ` Geert Uytterhoeven
2017-12-05 22:47 ` Frank Rowand
2017-12-04 15:47 ` [PATCH v2 2/2] of: overlay: Fix cleanup order in of_overlay_apply() Geert Uytterhoeven
2017-12-04 19:35 ` Rob Herring
2017-12-04 19:45 ` Geert Uytterhoeven
2017-12-05 1:16 ` Frank Rowand
2017-12-05 2:25 ` Rob Herring
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=64cf7e5d-176e-cae0-fd12-93825f2f14a2@gmail.com \
--to=frowand.list@gmail.com \
--cc=colin.king@canonical.com \
--cc=dan.carpenter@oracle.com \
--cc=devicetree@vger.kernel.org \
--cc=geert+renesas@glider.be \
--cc=geert@linux-m68k.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pantelis.antoniou@konsulko.com \
--cc=robh+dt@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).