[PATCH] fix the kernel panic due to wrong use the dev memory API

[PATCH] fix the kernel panic due to wrong use the dev memory API

[He, Bo]

skl->dais is allocated with devm_kcalloc, can't free with
the krealloc. Memory allocated with devm API is automatically freed
on driver detach, Like all other devres resources.

Refer to drivers/base/devres.c devm_kmalloc for more details.

Signed-off-by: he, bo <bo.he@intel.com>
---
 sound/soc/intel/skylake/skl-pcm.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index 823e391..928d314 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -1438,7 +1438,8 @@ int skl_platform_register(struct device *dev)
 	}
 
 	if (!skl->use_tplg_pcm) {
-		dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
+		devm_kfree(dev, skl->dais);
+		dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
 				sizeof(skl_platform_dai), GFP_KERNEL);
 		if (!dais) {
 			ret = -ENOMEM;
@@ -1472,7 +1473,5 @@ int skl_platform_unregister(struct device *dev)
 		}
 	}
 
-	kfree(skl->dais);
-
 	return 0;
 }
-- 
2.7.4

Re: [PATCH] fix the kernel panic due to wrong use the dev memory API

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 2856 bytes --]

Hi Bo,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on asoc/for-next]
[also build test WARNING on v4.20-rc1 next-20181105]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/He-Bo/fix-the-kernel-panic-due-to-wrong-use-the-dev-memory-API/20181105-175620
base:   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next
config: i386-randconfig-x014-201844 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
        # save the attached .config to linux build tree
        make ARCH=i386 

All warnings (new ones prefixed by >>):

   sound/soc/intel/skylake/skl-pcm.c: In function 'skl_platform_register':
>> sound/soc/intel/skylake/skl-pcm.c:1489:28: warning: passing argument 2 of 'devm_kcalloc' makes integer from pointer without a cast [-Wint-conversion]
      dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
                               ^~~
   In file included from include/linux/pci.h:31:0,
                    from sound/soc/intel/skylake/skl-pcm.c:22:
   include/linux/device.h:690:21: note: expected 'size_t {aka unsigned int}' but argument is of type 'struct snd_soc_dai_driver *'
    static inline void *devm_kcalloc(struct device *dev,
                        ^~~~~~~~~~~~

vim +/devm_kcalloc +1489 sound/soc/intel/skylake/skl-pcm.c

  1468	
  1469	int skl_platform_register(struct device *dev)
  1470	{
  1471		int ret;
  1472		struct snd_soc_dai_driver *dais;
  1473		int num_dais = ARRAY_SIZE(skl_platform_dai);
  1474		struct hdac_bus *bus = dev_get_drvdata(dev);
  1475		struct skl *skl = bus_to_skl(bus);
  1476	
  1477		INIT_LIST_HEAD(&skl->ppl_list);
  1478		INIT_LIST_HEAD(&skl->bind_list);
  1479	
  1480		skl->dais = kmemdup(skl_platform_dai, sizeof(skl_platform_dai),
  1481				    GFP_KERNEL);
  1482		if (!skl->dais) {
  1483			ret = -ENOMEM;
  1484			goto err;
  1485		}
  1486	
  1487		if (!skl->use_tplg_pcm) {
  1488			devm_kfree(dev, skl->dais);
> 1489			dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
  1490					sizeof(skl_platform_dai), GFP_KERNEL);
  1491			if (!dais) {
  1492				ret = -ENOMEM;
  1493				goto err;
  1494			}
  1495	
  1496			skl->dais = dais;
  1497			memcpy(&skl->dais[ARRAY_SIZE(skl_platform_dai)], skl_fe_dai,
  1498			       sizeof(skl_fe_dai));
  1499			num_dais += ARRAY_SIZE(skl_fe_dai);
  1500		}
  1501	
  1502		ret = devm_snd_soc_register_component(dev, &skl_component,
  1503						 skl->dais, num_dais);
  1504		if (ret)
  1505			dev_err(dev, "soc component registration failed %d\n", ret);
  1506	err:
  1507		return ret;
  1508	}
  1509	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 27737 bytes --]

Re: [alsa-devel] [PATCH] fix the kernel panic due to wrong use the dev memory API

[Pierre-Louis Bossart]

On 11/5/18 2:29 AM, He, Bo wrote:
> skl->dais is allocated with devm_kcalloc, can't free with
> the krealloc. Memory allocated with devm API is automatically freed
> on driver detach, Like all other devres resources.
>
> Refer to drivers/base/devres.c devm_kmalloc for more details.

What code are you looking at?

I see this in the Mark's tree

int skl_platform_register(struct device *dev)
{
     int ret;
     struct snd_soc_dai_driver *dais;
     int num_dais = ARRAY_SIZE(skl_platform_dai);
     struct hdac_bus *bus = dev_get_drvdata(dev);
     struct skl *skl = bus_to_skl(bus);

     INIT_LIST_HEAD(&skl->ppl_list);
     INIT_LIST_HEAD(&skl->bind_list);

     skl->dais = kmemdup(skl_platform_dai, sizeof(skl_platform_dai),
                 GFP_KERNEL);
     if (!skl->dais) {
         ret = -ENOMEM;
         goto err;
     }

     if (!skl->use_tplg_pcm) {
         dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
                 sizeof(skl_platform_dai), GFP_KERNEL);


No trace of devm as you mention it? I checked the Chrome tree as well 
and it's not there.

What am I missing?


>
> Signed-off-by: he, bo <bo.he@intel.com>
> ---
>   sound/soc/intel/skylake/skl-pcm.c | 5 ++---
>   1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
> index 823e391..928d314 100644
> --- a/sound/soc/intel/skylake/skl-pcm.c
> +++ b/sound/soc/intel/skylake/skl-pcm.c
> @@ -1438,7 +1438,8 @@ int skl_platform_register(struct device *dev)
>   	}
>   
>   	if (!skl->use_tplg_pcm) {
> -		dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
> +		devm_kfree(dev, skl->dais);
> +		dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
>   				sizeof(skl_platform_dai), GFP_KERNEL);
>   		if (!dais) {
>   			ret = -ENOMEM;
> @@ -1472,7 +1473,5 @@ int skl_platform_unregister(struct device *dev)
>   		}
>   	}
>   
> -	kfree(skl->dais);
> -
>   	return 0;
>   }

RE: [alsa-devel] [PATCH] fix the kernel panic due to wrong use the dev memory API

[He, Bo]

Hi, 
	I submit the patch based on tag v4.19.

-----Original Message-----
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> 
Sent: Tuesday, November 6, 2018 1:02 AM
To: He, Bo <bo.he@intel.com>; alsa-devel@alsa-project.org; linux-kernel@vger.kernel.org
Cc: liam.r.girdwood@linux.intel.com; perex@perex.cz; tiwai@suse.com; Singh, Guneshwor O <guneshwor.o.singh@intel.com>; Periyasamy, SriramX <sriramx.periyasamy@intel.com>; Kale, Sanyog R <sanyog.r.kale@intel.com>; Kesapragada, Pardha Saradhi <pardha.saradhi.kesapragada@intel.com>; kuninori.morimoto.gx@renesas.com; guruprasadx.pawse@intel.com; Ughreja, Rakesh A <rakesh.a.ughreja@intel.com>; Prakash, Divya1 <divya1.prakash@intel.com>; Diwakar, Praveen <praveen.diwakar@intel.com>; Zhang, Yanmin <yanmin.zhang@intel.com>
Subject: Re: [alsa-devel] [PATCH] fix the kernel panic due to wrong use the dev memory API


On 11/5/18 2:29 AM, He, Bo wrote:
> skl->dais is allocated with devm_kcalloc, can't free with
> the krealloc. Memory allocated with devm API is automatically freed on 
> driver detach, Like all other devres resources.
>
> Refer to drivers/base/devres.c devm_kmalloc for more details.

What code are you looking at?

I see this in the Mark's tree

int skl_platform_register(struct device *dev) {
     int ret;
     struct snd_soc_dai_driver *dais;
     int num_dais = ARRAY_SIZE(skl_platform_dai);
     struct hdac_bus *bus = dev_get_drvdata(dev);
     struct skl *skl = bus_to_skl(bus);

     INIT_LIST_HEAD(&skl->ppl_list);
     INIT_LIST_HEAD(&skl->bind_list);

     skl->dais = kmemdup(skl_platform_dai, sizeof(skl_platform_dai),
                 GFP_KERNEL);
     if (!skl->dais) {
         ret = -ENOMEM;
         goto err;
     }

     if (!skl->use_tplg_pcm) {
         dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
                 sizeof(skl_platform_dai), GFP_KERNEL);


No trace of devm as you mention it? I checked the Chrome tree as well and it's not there.

What am I missing?


>
> Signed-off-by: he, bo <bo.he@intel.com>
> ---
>   sound/soc/intel/skylake/skl-pcm.c | 5 ++---
>   1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/sound/soc/intel/skylake/skl-pcm.c 
> b/sound/soc/intel/skylake/skl-pcm.c
> index 823e391..928d314 100644
> --- a/sound/soc/intel/skylake/skl-pcm.c
> +++ b/sound/soc/intel/skylake/skl-pcm.c
> @@ -1438,7 +1438,8 @@ int skl_platform_register(struct device *dev)
>   	}
>   
>   	if (!skl->use_tplg_pcm) {
> -		dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
> +		devm_kfree(dev, skl->dais);
> +		dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
>   				sizeof(skl_platform_dai), GFP_KERNEL);
>   		if (!dais) {
>   			ret = -ENOMEM;
> @@ -1472,7 +1473,5 @@ int skl_platform_unregister(struct device *dev)
>   		}
>   	}
>   
> -	kfree(skl->dais);
> -
>   	return 0;
>   }

Re: [alsa-devel] [PATCH] fix the kernel panic due to wrong use the dev memory API

[Pierre-Louis Bossart]

On 11/5/18 6:58 PM, He, Bo wrote:
> Hi,
> 	I submit the patch based on tag v4.19.

Please don't post on mailing lists.

> 
> -----Original Message-----
> From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
> Sent: Tuesday, November 6, 2018 1:02 AM
> To: He, Bo <bo.he@intel.com>; alsa-devel@alsa-project.org; linux-kernel@vger.kernel.org
> Cc: liam.r.girdwood@linux.intel.com; perex@perex.cz; tiwai@suse.com; Singh, Guneshwor O <guneshwor.o.singh@intel.com>; Periyasamy, SriramX <sriramx.periyasamy@intel.com>; Kale, Sanyog R <sanyog.r.kale@intel.com>; Kesapragada, Pardha Saradhi <pardha.saradhi.kesapragada@intel.com>; kuninori.morimoto.gx@renesas.com; guruprasadx.pawse@intel.com; Ughreja, Rakesh A <rakesh.a.ughreja@intel.com>; Prakash, Divya1 <divya1.prakash@intel.com>; Diwakar, Praveen <praveen.diwakar@intel.com>; Zhang, Yanmin <yanmin.zhang@intel.com>
> Subject: Re: [alsa-devel] [PATCH] fix the kernel panic due to wrong use the dev memory API
> 
> 
> On 11/5/18 2:29 AM, He, Bo wrote:
>> skl->dais is allocated with devm_kcalloc, can't free with
>> the krealloc. Memory allocated with devm API is automatically freed on
>> driver detach, Like all other devres resources.
>>
>> Refer to drivers/base/devres.c devm_kmalloc for more details.
> 
> What code are you looking at?
> 
> I see this in the Mark's tree
> 
> int skl_platform_register(struct device *dev) {
>       int ret;
>       struct snd_soc_dai_driver *dais;
>       int num_dais = ARRAY_SIZE(skl_platform_dai);
>       struct hdac_bus *bus = dev_get_drvdata(dev);
>       struct skl *skl = bus_to_skl(bus);
> 
>       INIT_LIST_HEAD(&skl->ppl_list);
>       INIT_LIST_HEAD(&skl->bind_list);
> 
>       skl->dais = kmemdup(skl_platform_dai, sizeof(skl_platform_dai),
>                   GFP_KERNEL);
>       if (!skl->dais) {
>           ret = -ENOMEM;
>           goto err;
>       }
> 
>       if (!skl->use_tplg_pcm) {
>           dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
>                   sizeof(skl_platform_dai), GFP_KERNEL);
> 
> 
> No trace of devm as you mention it? I checked the Chrome tree as well and it's not there.
> 
> What am I missing?

The code is completely identical in v4.19. skl->dais is allocated with 
kmemdup, which is a kmalloc+memcpy, i just don't understand what you are 
trying to fix.

> 
> 
>>
>> Signed-off-by: he, bo <bo.he@intel.com>
>> ---
>>    sound/soc/intel/skylake/skl-pcm.c | 5 ++---
>>    1 file changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/sound/soc/intel/skylake/skl-pcm.c
>> b/sound/soc/intel/skylake/skl-pcm.c
>> index 823e391..928d314 100644
>> --- a/sound/soc/intel/skylake/skl-pcm.c
>> +++ b/sound/soc/intel/skylake/skl-pcm.c
>> @@ -1438,7 +1438,8 @@ int skl_platform_register(struct device *dev)
>>    	}
>>    
>>    	if (!skl->use_tplg_pcm) {
>> -		dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
>> +		devm_kfree(dev, skl->dais);
>> +		dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
>>    				sizeof(skl_platform_dai), GFP_KERNEL);
>>    		if (!dais) {
>>    			ret = -ENOMEM;
>> @@ -1472,7 +1473,5 @@ int skl_platform_unregister(struct device *dev)
>>    		}
>>    	}
>>    
>> -	kfree(skl->dais);
>> -
>>    	return 0;
>>    }