* [PATCH v3] fsi: Aspeed: Fix a potential double free
@ 2022-01-09 21:56 Christophe JAILLET
2022-01-10 17:01 ` Guenter Roeck
2022-02-21 9:24 ` Joel Stanley
0 siblings, 2 replies; 4+ messages in thread
From: Christophe JAILLET @ 2022-01-09 21:56 UTC (permalink / raw)
To: Jeremy Kerr, Joel Stanley, Alistar Popple, Eddie James,
Andrew Jeffery, Greg Kroah-Hartman
Cc: linux-kernel, kernel-janitors, Christophe JAILLET, Guenter Roeck,
linux-fsi, linux-arm-kernel, linux-aspeed
A struct device can never be devm_alloc()'ed.
Here, it is embedded in "struct fsi_master", and "struct fsi_master" is
embedded in "struct fsi_master_aspeed".
Since "struct device" is embedded, the data structure embedding it must be
released with the release function, as is already done here.
So use kzalloc() instead of devm_kzalloc() when allocating "aspeed" and
update all error handling branches accordingly.
This prevent a potential double free().
This also fix another issue if opb_readl() fails. Instead of a direct
return, it now jumps in the error handling path.
Fixes: 606397d67f41 ("fsi: Add ast2600 master driver")
Suggested-by: Greg KH <gregkh@linuxfoundation.org>
Suggested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
v2: Keep the release function which is correct
s/devm_kzalloc()/kzalloc()/ instead
v3: Update the error handling path to free "aspeed" [Guenter Roeck]
Fix another issue when opb_readl() fails [Guenter Roeck]
I hope that fixing both issues in the same patch is ok. It makes no sense
to me not to update the goto to the correct label if opb_readl() fails.
---
drivers/fsi/fsi-master-aspeed.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
index 8606e55c1721..0bed2fab8055 100644
--- a/drivers/fsi/fsi-master-aspeed.c
+++ b/drivers/fsi/fsi-master-aspeed.c
@@ -542,25 +542,28 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
return rc;
}
- aspeed = devm_kzalloc(&pdev->dev, sizeof(*aspeed), GFP_KERNEL);
+ aspeed = kzalloc(sizeof(*aspeed), GFP_KERNEL);
if (!aspeed)
return -ENOMEM;
aspeed->dev = &pdev->dev;
aspeed->base = devm_platform_ioremap_resource(pdev, 0);
- if (IS_ERR(aspeed->base))
- return PTR_ERR(aspeed->base);
+ if (IS_ERR(aspeed->base)) {
+ rc = PTR_ERR(aspeed->base);
+ goto err_free_aspeed;
+ }
aspeed->clk = devm_clk_get(aspeed->dev, NULL);
if (IS_ERR(aspeed->clk)) {
dev_err(aspeed->dev, "couldn't get clock\n");
- return PTR_ERR(aspeed->clk);
+ rc = PTR_ERR(aspeed->clk);
+ goto err_free_aspeed;
}
rc = clk_prepare_enable(aspeed->clk);
if (rc) {
dev_err(aspeed->dev, "couldn't enable clock\n");
- return rc;
+ goto err_free_aspeed;
}
rc = setup_cfam_reset(aspeed);
@@ -595,7 +598,7 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
rc = opb_readl(aspeed, ctrl_base + FSI_MVER, &raw);
if (rc) {
dev_err(&pdev->dev, "failed to read hub version\n");
- return rc;
+ goto err_release;
}
reg = be32_to_cpu(raw);
@@ -634,6 +637,8 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
err_release:
clk_disable_unprepare(aspeed->clk);
+err_free_aspeed:
+ kfree(aspeed);
return rc;
}
--
2.32.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v3] fsi: Aspeed: Fix a potential double free
2022-01-09 21:56 [PATCH v3] fsi: Aspeed: Fix a potential double free Christophe JAILLET
@ 2022-01-10 17:01 ` Guenter Roeck
2022-02-21 9:24 ` Joel Stanley
1 sibling, 0 replies; 4+ messages in thread
From: Guenter Roeck @ 2022-01-10 17:01 UTC (permalink / raw)
To: Christophe JAILLET, Jeremy Kerr, Joel Stanley, Alistar Popple,
Eddie James, Andrew Jeffery, Greg Kroah-Hartman
Cc: linux-kernel, kernel-janitors, linux-fsi, linux-arm-kernel, linux-aspeed
On 1/9/22 1:56 PM, Christophe JAILLET wrote:
> A struct device can never be devm_alloc()'ed.
> Here, it is embedded in "struct fsi_master", and "struct fsi_master" is
> embedded in "struct fsi_master_aspeed".
>
> Since "struct device" is embedded, the data structure embedding it must be
> released with the release function, as is already done here.
>
> So use kzalloc() instead of devm_kzalloc() when allocating "aspeed" and
> update all error handling branches accordingly.
>
> This prevent a potential double free().
>
> This also fix another issue if opb_readl() fails. Instead of a direct
> return, it now jumps in the error handling path.
>
> Fixes: 606397d67f41 ("fsi: Add ast2600 master driver")
> Suggested-by: Greg KH <gregkh@linuxfoundation.org>
> Suggested-by: Guenter Roeck <linux@roeck-us.net>
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
> ---
> v2: Keep the release function which is correct
> s/devm_kzalloc()/kzalloc()/ instead
>
> v3: Update the error handling path to free "aspeed" [Guenter Roeck]
> Fix another issue when opb_readl() fails [Guenter Roeck]
>
> I hope that fixing both issues in the same patch is ok. It makes no sense
> to me not to update the goto to the correct label if opb_readl() fails.
> ---
> drivers/fsi/fsi-master-aspeed.c | 17 +++++++++++------
> 1 file changed, 11 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
> index 8606e55c1721..0bed2fab8055 100644
> --- a/drivers/fsi/fsi-master-aspeed.c
> +++ b/drivers/fsi/fsi-master-aspeed.c
> @@ -542,25 +542,28 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
> return rc;
> }
>
> - aspeed = devm_kzalloc(&pdev->dev, sizeof(*aspeed), GFP_KERNEL);
> + aspeed = kzalloc(sizeof(*aspeed), GFP_KERNEL);
> if (!aspeed)
> return -ENOMEM;
>
> aspeed->dev = &pdev->dev;
>
> aspeed->base = devm_platform_ioremap_resource(pdev, 0);
> - if (IS_ERR(aspeed->base))
> - return PTR_ERR(aspeed->base);
> + if (IS_ERR(aspeed->base)) {
> + rc = PTR_ERR(aspeed->base);
> + goto err_free_aspeed;
> + }
>
> aspeed->clk = devm_clk_get(aspeed->dev, NULL);
> if (IS_ERR(aspeed->clk)) {
> dev_err(aspeed->dev, "couldn't get clock\n");
> - return PTR_ERR(aspeed->clk);
> + rc = PTR_ERR(aspeed->clk);
> + goto err_free_aspeed;
> }
> rc = clk_prepare_enable(aspeed->clk);
> if (rc) {
> dev_err(aspeed->dev, "couldn't enable clock\n");
> - return rc;
> + goto err_free_aspeed;
> }
>
> rc = setup_cfam_reset(aspeed);
> @@ -595,7 +598,7 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
> rc = opb_readl(aspeed, ctrl_base + FSI_MVER, &raw);
> if (rc) {
> dev_err(&pdev->dev, "failed to read hub version\n");
> - return rc;
> + goto err_release;
> }
>
> reg = be32_to_cpu(raw);
> @@ -634,6 +637,8 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
>
> err_release:
> clk_disable_unprepare(aspeed->clk);
> +err_free_aspeed:
> + kfree(aspeed);
> return rc;
> }
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3] fsi: Aspeed: Fix a potential double free
2022-01-09 21:56 [PATCH v3] fsi: Aspeed: Fix a potential double free Christophe JAILLET
2022-01-10 17:01 ` Guenter Roeck
@ 2022-02-21 9:24 ` Joel Stanley
2022-02-21 18:08 ` Christophe JAILLET
1 sibling, 1 reply; 4+ messages in thread
From: Joel Stanley @ 2022-02-21 9:24 UTC (permalink / raw)
To: Christophe JAILLET
Cc: Jeremy Kerr, Alistar Popple, Eddie James, Andrew Jeffery,
Greg Kroah-Hartman, Linux Kernel Mailing List, kernel-janitors,
Guenter Roeck, linux-fsi, Linux ARM, linux-aspeed
Hi Christophe,
Thanks for the patch.
On Sun, 9 Jan 2022 at 21:56, Christophe JAILLET
<christophe.jaillet@wanadoo.fr> wrote:
>
> A struct device can never be devm_alloc()'ed.
> Here, it is embedded in "struct fsi_master", and "struct fsi_master" is
> embedded in "struct fsi_master_aspeed".
>
> Since "struct device" is embedded, the data structure embedding it must be
> released with the release function, as is already done here.
>
> So use kzalloc() instead of devm_kzalloc() when allocating "aspeed" and
> update all error handling branches accordingly.
This looks like a problem with the design of the fsi master structure.
It's a common pattern to devm_alloc the platform devices as they are
probed, the fsi masters all embed a copy of struct fsi_master, which
as you say embeds struct device.
Can we learn from other bus drivers (eg i2c?) how we should lay out
these structures?
>
> This prevent a potential double free().
>
> This also fix another issue if opb_readl() fails. Instead of a direct
> return, it now jumps in the error handling path.
>
> Fixes: 606397d67f41 ("fsi: Add ast2600 master driver")
> Suggested-by: Greg KH <gregkh@linuxfoundation.org>
> Suggested-by: Guenter Roeck <linux@roeck-us.net>
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> ---
> v2: Keep the release function which is correct
> s/devm_kzalloc()/kzalloc()/ instead
>
> v3: Update the error handling path to free "aspeed" [Guenter Roeck]
> Fix another issue when opb_readl() fails [Guenter Roeck]
>
> I hope that fixing both issues in the same patch is ok. It makes no sense
> to me not to update the goto to the correct label if opb_readl() fails.
> ---
> drivers/fsi/fsi-master-aspeed.c | 17 +++++++++++------
> 1 file changed, 11 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
> index 8606e55c1721..0bed2fab8055 100644
> --- a/drivers/fsi/fsi-master-aspeed.c
> +++ b/drivers/fsi/fsi-master-aspeed.c
> @@ -542,25 +542,28 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
> return rc;
> }
>
> - aspeed = devm_kzalloc(&pdev->dev, sizeof(*aspeed), GFP_KERNEL);
> + aspeed = kzalloc(sizeof(*aspeed), GFP_KERNEL);
> if (!aspeed)
> return -ENOMEM;
>
> aspeed->dev = &pdev->dev;
>
> aspeed->base = devm_platform_ioremap_resource(pdev, 0);
> - if (IS_ERR(aspeed->base))
> - return PTR_ERR(aspeed->base);
> + if (IS_ERR(aspeed->base)) {
> + rc = PTR_ERR(aspeed->base);
> + goto err_free_aspeed;
> + }
>
> aspeed->clk = devm_clk_get(aspeed->dev, NULL);
> if (IS_ERR(aspeed->clk)) {
> dev_err(aspeed->dev, "couldn't get clock\n");
> - return PTR_ERR(aspeed->clk);
> + rc = PTR_ERR(aspeed->clk);
> + goto err_free_aspeed;
> }
> rc = clk_prepare_enable(aspeed->clk);
> if (rc) {
> dev_err(aspeed->dev, "couldn't enable clock\n");
> - return rc;
> + goto err_free_aspeed;
> }
>
> rc = setup_cfam_reset(aspeed);
> @@ -595,7 +598,7 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
> rc = opb_readl(aspeed, ctrl_base + FSI_MVER, &raw);
> if (rc) {
> dev_err(&pdev->dev, "failed to read hub version\n");
> - return rc;
> + goto err_release;
> }
>
> reg = be32_to_cpu(raw);
> @@ -634,6 +637,8 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev)
>
> err_release:
> clk_disable_unprepare(aspeed->clk);
> +err_free_aspeed:
> + kfree(aspeed);
> return rc;
> }
>
> --
> 2.32.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3] fsi: Aspeed: Fix a potential double free
2022-02-21 9:24 ` Joel Stanley
@ 2022-02-21 18:08 ` Christophe JAILLET
0 siblings, 0 replies; 4+ messages in thread
From: Christophe JAILLET @ 2022-02-21 18:08 UTC (permalink / raw)
To: Joel Stanley
Cc: Jeremy Kerr, Alistar Popple, Eddie James, Andrew Jeffery,
Greg Kroah-Hartman, Linux Kernel Mailing List, kernel-janitors,
Guenter Roeck, linux-fsi, Linux ARM, linux-aspeed
Le 21/02/2022 à 10:24, Joel Stanley a écrit :
> Hi Christophe,
>
> Thanks for the patch.
>
> On Sun, 9 Jan 2022 at 21:56, Christophe JAILLET
> <christophe.jaillet@wanadoo.fr> wrote:
>>
>> A struct device can never be devm_alloc()'ed.
>> Here, it is embedded in "struct fsi_master", and "struct fsi_master" is
>> embedded in "struct fsi_master_aspeed".
>>
>> Since "struct device" is embedded, the data structure embedding it must be
>> released with the release function, as is already done here.
>>
>> So use kzalloc() instead of devm_kzalloc() when allocating "aspeed" and
>> update all error handling branches accordingly.
>
> This looks like a problem with the design of the fsi master structure.
> It's a common pattern to devm_alloc the platform devices as they are
> probed, the fsi masters all embed a copy of struct fsi_master, which
> as you say embeds struct device.
>
> Can we learn from other bus drivers (eg i2c?) how we should lay out
> these structures?
>
Hi,
I won't do it myself.
This goes beyond my knowledge and without the possibility to test it, it
would be just some random trial and error (as I did in the first broken
version of this patch).
CJ
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-02-21 18:19 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-09 21:56 [PATCH v3] fsi: Aspeed: Fix a potential double free Christophe JAILLET
2022-01-10 17:01 ` Guenter Roeck
2022-02-21 9:24 ` Joel Stanley
2022-02-21 18:08 ` Christophe JAILLET
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).