From: Bjorn Andersson <bjorn.andersson@linaro.org>
To: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
"Rafael J. Wysocki" <rafael@kernel.org>,
Stuart Yoder <stuyoder@gmail.com>,
Laurentiu Tudor <laurentiu.tudor@nxp.com>,
Abel Vesa <abel.vesa@nxp.com>, Shawn Guo <shawnguo@kernel.org>,
Sascha Hauer <s.hauer@pengutronix.de>,
Fabio Estevam <festevam@gmail.com>,
"K. Y. Srinivasan" <kys@microsoft.com>,
Haiyang Zhang <haiyangz@microsoft.com>,
Stephen Hemminger <sthemmin@microsoft.com>,
Wei Liu <wei.liu@kernel.org>, Dexuan Cui <decui@microsoft.com>,
Bjorn Helgaas <bhelgaas@google.com>,
Mathieu Poirier <mathieu.poirier@linaro.org>,
Vineeth Vijayan <vneethv@linux.ibm.com>,
Peter Oberparleiter <oberpar@linux.ibm.com>,
Heiko Carstens <hca@linux.ibm.com>,
Vasily Gorbik <gor@linux.ibm.com>,
Alexander Gordeev <agordeev@linux.ibm.com>,
Christian Borntraeger <borntraeger@linux.ibm.com>,
Sven Schnelle <svens@linux.ibm.com>,
Andy Gross <agross@kernel.org>,
Srinivas Kandagatla <srinivas.kandagatla@linaro.org>,
Mark Brown <broonie@kernel.org>,
"Michael S. Tsirkin" <mst@redhat.com>,
Jason Wang <jasowang@redhat.com>,
linux-kernel@vger.kernel.org, linux-clk@vger.kernel.org,
NXP Linux Team <linux-imx@nxp.com>,
linux-arm-kernel@lists.infradead.org,
linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org,
linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org,
linux-arm-msm@vger.kernel.org, alsa-devel@alsa-project.org,
linux-spi@vger.kernel.org,
virtualization@lists.linux-foundation.org,
Linus Torvalds <torvalds@linux-foundation.org>,
Rasmus Villemoes <linux@rasmusvillemoes.dk>,
stable@vger.kernel.org
Subject: Re: [PATCH v3 11/11] rpmsg: Fix kfree() of static memory on setting driver_override
Date: Fri, 11 Mar 2022 14:19:00 -0600 [thread overview]
Message-ID: <YiuutCsuf4j192cJ@builder.lan> (raw)
In-Reply-To: <20220227135329.145862-5-krzysztof.kozlowski@canonical.com>
On Sun 27 Feb 07:53 CST 2022, Krzysztof Kozlowski wrote:
> The driver_override field from platform driver should not be initialized
> from static memory (string literal) because the core later kfree() it,
> for example when driver_override is set via sysfs.
>
> Use dedicated helper to set driver_override properly.
>
> Fixes: 950a7388f02b ("rpmsg: Turn name service into a stand alone driver")
> Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Regards,
Bjorn
> ---
> drivers/rpmsg/rpmsg_core.c | 3 ++-
> drivers/rpmsg/rpmsg_internal.h | 13 +++++++++++--
> drivers/rpmsg/rpmsg_ns.c | 14 ++++++++++++--
> include/linux/rpmsg.h | 6 ++++--
> 4 files changed, 29 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
> index d9e612f4f0f2..6e2bf2742973 100644
> --- a/drivers/rpmsg/rpmsg_core.c
> +++ b/drivers/rpmsg/rpmsg_core.c
> @@ -397,7 +397,8 @@ field##_store(struct device *dev, struct device_attribute *attr, \
> const char *buf, size_t sz) \
> { \
> struct rpmsg_device *rpdev = to_rpmsg_device(dev); \
> - char *new, *old; \
> + const char *old; \
> + char *new; \
> \
> new = kstrndup(buf, sz, GFP_KERNEL); \
> if (!new) \
> diff --git a/drivers/rpmsg/rpmsg_internal.h b/drivers/rpmsg/rpmsg_internal.h
> index b1245d3ed7c6..31345d6e9a7e 100644
> --- a/drivers/rpmsg/rpmsg_internal.h
> +++ b/drivers/rpmsg/rpmsg_internal.h
> @@ -92,10 +92,19 @@ int rpmsg_release_channel(struct rpmsg_device *rpdev,
> */
> static inline int rpmsg_chrdev_register_device(struct rpmsg_device *rpdev)
> {
> + int ret;
> +
> strcpy(rpdev->id.name, "rpmsg_chrdev");
> - rpdev->driver_override = "rpmsg_chrdev";
> + ret = driver_set_override(&rpdev->dev, &rpdev->driver_override,
> + "rpmsg_chrdev", strlen("rpmsg_chrdev"));
> + if (ret)
> + return ret;
> +
> + ret = rpmsg_register_device(rpdev);
> + if (ret)
> + kfree(rpdev->driver_override);
>
> - return rpmsg_register_device(rpdev);
> + return ret;
> }
>
> #endif
> diff --git a/drivers/rpmsg/rpmsg_ns.c b/drivers/rpmsg/rpmsg_ns.c
> index 762ff1ae279f..95a51543f5ad 100644
> --- a/drivers/rpmsg/rpmsg_ns.c
> +++ b/drivers/rpmsg/rpmsg_ns.c
> @@ -20,12 +20,22 @@
> */
> int rpmsg_ns_register_device(struct rpmsg_device *rpdev)
> {
> + int ret;
> +
> strcpy(rpdev->id.name, "rpmsg_ns");
> - rpdev->driver_override = "rpmsg_ns";
> + ret = driver_set_override(&rpdev->dev, &rpdev->driver_override,
> + "rpmsg_ns", strlen("rpmsg_ns"));
> + if (ret)
> + return ret;
> +
> rpdev->src = RPMSG_NS_ADDR;
> rpdev->dst = RPMSG_NS_ADDR;
>
> - return rpmsg_register_device(rpdev);
> + ret = rpmsg_register_device(rpdev);
> + if (ret)
> + kfree(rpdev->driver_override);
> +
> + return ret;
> }
> EXPORT_SYMBOL(rpmsg_ns_register_device);
>
> diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h
> index 02fa9116cd60..20c8cd1cde21 100644
> --- a/include/linux/rpmsg.h
> +++ b/include/linux/rpmsg.h
> @@ -41,7 +41,9 @@ struct rpmsg_channel_info {
> * rpmsg_device - device that belong to the rpmsg bus
> * @dev: the device struct
> * @id: device id (used to match between rpmsg drivers and devices)
> - * @driver_override: driver name to force a match
> + * @driver_override: driver name to force a match; do not set directly,
> + * because core frees it; use driver_set_override() to
> + * set or clear it.
> * @src: local address
> * @dst: destination address
> * @ept: the rpmsg endpoint of this channel
> @@ -51,7 +53,7 @@ struct rpmsg_channel_info {
> struct rpmsg_device {
> struct device dev;
> struct rpmsg_device_id id;
> - char *driver_override;
> + const char *driver_override;
> u32 src;
> u32 dst;
> struct rpmsg_endpoint *ept;
> --
> 2.32.0
>
prev parent reply other threads:[~2022-03-11 20:19 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-27 13:52 [PATCH v3 00/11] Fix broken usage of driver_override (and kfree of static memory) Krzysztof Kozlowski
2022-02-27 13:52 ` [PATCH v3 01/11] driver: platform: Add helper for safer setting of driver_override Krzysztof Kozlowski
2022-02-28 10:51 ` Abel Vesa
2022-02-28 11:30 ` Krzysztof Kozlowski
2022-02-28 11:56 ` Abel Vesa
2022-02-28 20:03 ` Bjorn Helgaas
2022-03-01 8:49 ` Krzysztof Kozlowski
2022-02-27 13:52 ` [PATCH v3 02/11] amba: Use driver_set_override() instead of open-coding Krzysztof Kozlowski
2022-02-27 13:52 ` [PATCH v3 03/11] fsl-mc: " Krzysztof Kozlowski
2022-02-27 13:52 ` [PATCH v3 04/11] hv: " Krzysztof Kozlowski
2022-02-27 15:53 ` Michael Kelley (LINUX)
2022-02-27 13:52 ` [PATCH v3 05/11] PCI: " Krzysztof Kozlowski
2022-02-28 20:06 ` Bjorn Helgaas
2022-03-01 8:41 ` Krzysztof Kozlowski
2022-02-27 13:52 ` [PATCH v3 06/11] s390: cio: " Krzysztof Kozlowski
2022-03-01 16:01 ` Vineeth Vijayan
2022-03-02 11:01 ` Krzysztof Kozlowski
2022-02-27 13:53 ` [PATCH v3 07/11] spi: Use helper for safer setting of driver_override Krzysztof Kozlowski
2022-02-28 13:07 ` Mark Brown
2022-02-27 13:53 ` [PATCH v3 08/11] vdpa: " Krzysztof Kozlowski
2022-02-27 13:53 ` [PATCH v3 09/11] clk: imx: scu: Fix kfree() of static memory on setting driver_override Krzysztof Kozlowski
2022-02-28 10:55 ` Abel Vesa
2022-02-27 13:53 ` [PATCH v3 10/11] slimbus: qcom-ngd: " Krzysztof Kozlowski
2022-03-01 17:28 ` Srinivas Kandagatla
2022-02-27 13:53 ` [PATCH v3 11/11] rpmsg: " Krzysztof Kozlowski
2022-03-11 20:19 ` Bjorn Andersson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YiuutCsuf4j192cJ@builder.lan \
--to=bjorn.andersson@linaro.org \
--cc=abel.vesa@nxp.com \
--cc=agordeev@linux.ibm.com \
--cc=agross@kernel.org \
--cc=alsa-devel@alsa-project.org \
--cc=bhelgaas@google.com \
--cc=borntraeger@linux.ibm.com \
--cc=broonie@kernel.org \
--cc=decui@microsoft.com \
--cc=festevam@gmail.com \
--cc=gor@linux.ibm.com \
--cc=gregkh@linuxfoundation.org \
--cc=haiyangz@microsoft.com \
--cc=hca@linux.ibm.com \
--cc=jasowang@redhat.com \
--cc=krzysztof.kozlowski@canonical.com \
--cc=kys@microsoft.com \
--cc=laurentiu.tudor@nxp.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-clk@vger.kernel.org \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-imx@nxp.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=linux-remoteproc@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=linux@rasmusvillemoes.dk \
--cc=mathieu.poirier@linaro.org \
--cc=mst@redhat.com \
--cc=oberpar@linux.ibm.com \
--cc=rafael@kernel.org \
--cc=s.hauer@pengutronix.de \
--cc=shawnguo@kernel.org \
--cc=srinivas.kandagatla@linaro.org \
--cc=stable@vger.kernel.org \
--cc=sthemmin@microsoft.com \
--cc=stuyoder@gmail.com \
--cc=svens@linux.ibm.com \
--cc=torvalds@linux-foundation.org \
--cc=virtualization@lists.linux-foundation.org \
--cc=vneethv@linux.ibm.com \
--cc=wei.liu@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).