From: Frank Rowand <frowand.list@gmail.com>
To: Geert Uytterhoeven <geert+renesas@glider.be>,
Pantelis Antoniou <pantelis.antoniou@konsulko.com>,
Rob Herring <robh+dt@kernel.org>
Cc: Colin King <colin.king@canonical.com>,
Dan Carpenter <dan.carpenter@oracle.com>,
devicetree@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 1/2] of: overlay: Fix memory leak in of_overlay_apply() error path
Date: Mon, 4 Dec 2017 21:07:25 -0500 [thread overview]
Message-ID: <b6392405-390d-d7dc-91b2-1338fd605e65@gmail.com> (raw)
In-Reply-To: <1512402456-8176-2-git-send-email-geert+renesas@glider.be>
Hi Geert,
Thanks for finding the issues and for the fixes.
Comments in line.
On 12/04/17 10:47, Geert Uytterhoeven wrote:
> If of_resolve_phandles() fails, free_overlay_changeset() is called in
> the error path. However, that function returns early if the list hasn't
> been initialized yet, before freeing the object.
>
> Explicitly calling kfree() instead would solve that issue. However, that
> complicates matter, by having to consider which of two different methods
> to use to dispose of the same object.
>
> Hence make free_overlay_changeset() consider initialization state of the
> different parts of the object, making it always safe to call (once!) to
> dispose of a (partially) initialized overlay_changeset:
> - Only destroy the changeset if the list was initialized,
> - Ignore uninitialized IDs (zero).
>
> Reported-by: Colin King <colin.king@canonical.com>
> Fixes: f948d6d8b792bb90 ("of: overlay: avoid race condition between applying multiple overlays")
> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
> ---
> drivers/of/overlay.c | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
> index 3b7a3980ff50d6bf..312cd658bec0083b 100644
> --- a/drivers/of/overlay.c
> +++ b/drivers/of/overlay.c
> @@ -630,11 +630,10 @@ static void free_overlay_changeset(struct overlay_changeset *ovcs)
> {
> int i;
>
> - if (!ovcs->cset.entries.next)
> - return;
> - of_changeset_destroy(&ovcs->cset);
> + if (ovcs->cset.entries.next)
> + of_changeset_destroy(&ovcs->cset);
>
OK
> - if (ovcs->id)
> + if (ovcs->id > 0)
Instead of this change, could you please make a change in init_overlay_changeset()?
Current init_overlay_changeset():
ovcs->id = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL);
if (ovcs->id <= 0)
return ovcs->id;
My proposed version:
ret = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL);
if (ret <= 0)
return ret;
ovcs->id = ret;
> idr_remove(&ovcs_idr, ovcs->id);
>
> for (i = 0; i < ovcs->count; i++) {
>
Also, the previous version of the patch, and the discussion around the resulting
bug make me think that I should not have moved 'kfree(ovcs)' into
free_overlay_changeset(), because that kfree is then not very visible in the
error path of of_overlay_apply(). Could you remove 'kfree(ovcs)' from
free_overlay_changeset(), and instead call it immediately after each call
to free_overlay_changeset()?
-Frank
next prev parent reply other threads:[~2017-12-05 2:07 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-12-04 15:47 [PATCH v2 0/2] of: overlay: Fix of_overlay_apply() error path Geert Uytterhoeven
2017-12-04 15:47 ` [PATCH v2 1/2] of: overlay: Fix memory leak in " Geert Uytterhoeven
2017-12-05 2:07 ` Frank Rowand [this message]
2017-12-05 8:01 ` Geert Uytterhoeven
2017-12-05 10:49 ` Geert Uytterhoeven
2017-12-05 13:46 ` Frank Rowand
2017-12-05 13:45 ` Frank Rowand
2017-12-05 13:58 ` Geert Uytterhoeven
2017-12-05 22:47 ` Frank Rowand
2017-12-04 15:47 ` [PATCH v2 2/2] of: overlay: Fix cleanup order in of_overlay_apply() Geert Uytterhoeven
2017-12-04 19:35 ` Rob Herring
2017-12-04 19:45 ` Geert Uytterhoeven
2017-12-05 1:16 ` Frank Rowand
2017-12-05 2:25 ` Rob Herring
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b6392405-390d-d7dc-91b2-1338fd605e65@gmail.com \
--to=frowand.list@gmail.com \
--cc=colin.king@canonical.com \
--cc=dan.carpenter@oracle.com \
--cc=devicetree@vger.kernel.org \
--cc=geert+renesas@glider.be \
--cc=linux-kernel@vger.kernel.org \
--cc=pantelis.antoniou@konsulko.com \
--cc=robh+dt@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).