From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752195AbdLECHp (ORCPT ); Mon, 4 Dec 2017 21:07:45 -0500 Received: from mail-pg0-f65.google.com ([74.125.83.65]:45451 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750995AbdLECHn (ORCPT ); Mon, 4 Dec 2017 21:07:43 -0500 X-Google-Smtp-Source: AGs4zMa3Xi0kUMtV26T0OkYGM6p/KkpcIIrRqGMg3pYc/+DlorggLmn0o+Fi0PBsigxRCj8fG+mCMQ== Subject: Re: [PATCH v2 1/2] of: overlay: Fix memory leak in of_overlay_apply() error path To: Geert Uytterhoeven , Pantelis Antoniou , Rob Herring Cc: Colin King , Dan Carpenter , devicetree@vger.kernel.org, linux-kernel@vger.kernel.org References: <1512402456-8176-1-git-send-email-geert+renesas@glider.be> <1512402456-8176-2-git-send-email-geert+renesas@glider.be> From: Frank Rowand Message-ID: Date: Mon, 4 Dec 2017 21:07:25 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <1512402456-8176-2-git-send-email-geert+renesas@glider.be> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Geert, Thanks for finding the issues and for the fixes. Comments in line. On 12/04/17 10:47, Geert Uytterhoeven wrote: > If of_resolve_phandles() fails, free_overlay_changeset() is called in > the error path. However, that function returns early if the list hasn't > been initialized yet, before freeing the object. > > Explicitly calling kfree() instead would solve that issue. However, that > complicates matter, by having to consider which of two different methods > to use to dispose of the same object. > > Hence make free_overlay_changeset() consider initialization state of the > different parts of the object, making it always safe to call (once!) to > dispose of a (partially) initialized overlay_changeset: > - Only destroy the changeset if the list was initialized, > - Ignore uninitialized IDs (zero). > > Reported-by: Colin King > Fixes: f948d6d8b792bb90 ("of: overlay: avoid race condition between applying multiple overlays") > Signed-off-by: Geert Uytterhoeven > --- > drivers/of/overlay.c | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) > > diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c > index 3b7a3980ff50d6bf..312cd658bec0083b 100644 > --- a/drivers/of/overlay.c > +++ b/drivers/of/overlay.c > @@ -630,11 +630,10 @@ static void free_overlay_changeset(struct overlay_changeset *ovcs) > { > int i; > > - if (!ovcs->cset.entries.next) > - return; > - of_changeset_destroy(&ovcs->cset); > + if (ovcs->cset.entries.next) > + of_changeset_destroy(&ovcs->cset); > OK > - if (ovcs->id) > + if (ovcs->id > 0) Instead of this change, could you please make a change in init_overlay_changeset()? Current init_overlay_changeset(): ovcs->id = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL); if (ovcs->id <= 0) return ovcs->id; My proposed version: ret = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL); if (ret <= 0) return ret; ovcs->id = ret; > idr_remove(&ovcs_idr, ovcs->id); > > for (i = 0; i < ovcs->count; i++) { > Also, the previous version of the patch, and the discussion around the resulting bug make me think that I should not have moved 'kfree(ovcs)' into free_overlay_changeset(), because that kfree is then not very visible in the error path of of_overlay_apply(). Could you remove 'kfree(ovcs)' from free_overlay_changeset(), and instead call it immediately after each call to free_overlay_changeset()? -Frank