From: Yann Droneaud <ydroneaud@opteya.com>
To: Julia Lawall <Julia.Lawall@lip6.fr>,
Gilles Muller <Gilles.Muller@lip6.fr>,
Nicolas Palix <nicolas.palix@imag.fr>,
Michal Marek <mmarek@suse.com>
Cc: Tejun Heo <tj@kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
cocci@systeme.lip6.fr, linux-kernel@vger.kernel.org,
Yann Droneaud <ydroneaud@opteya.com>,
Pekka Enberg <penberg@cs.helsinki.fi>
Subject: [PATCH v2 3/3] coccinelle: catch krealloc() on devm_*() allocated memory
Date: Mon, 23 May 2016 17:07:21 +0200 [thread overview]
Message-ID: <9a230c4f8a38b6a029bec56b7a005d2e2cd7a324.1464013817.git.ydroneaud@opteya.com> (raw)
In-Reply-To: <cover.1464013817.git.ydroneaud@opteya.com>
In-Reply-To: <cover.1464013817.git.ydroneaud@opteya.com>
krealloc() must not be used against devm_*() allocated
memory regions:
- if a bigger memory is to be allocated, krealloc() and
__krealloc() could return a different pointer than the
one given to them, creating a memory region which is not
managed, thus it will not be automatically released on
device removal.
- if a bigger memory is to be allocated, krealloc() could
kfree() the managed memory region which is passed to it.
The old pointer is left registered as a resource for the
device. On device removal, this dangling pointer will be
used and an unrelated memory region could be released.
- if the requested size is equal to 0, krealloc() can also
just behave like kfree(). Here too, the old pointer is
kept associated with the device. On device removal, this
invalid pointer will be used and an unrelated memory
region could be released.
For all these reasons, krealloc() must not be used on a
pointer returned by devm_*() functions.
Cc: Tejun Heo <tj@kernel.org>
Cc: Pekka Enberg <penberg@cs.helsinki.fi>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
---
scripts/coccinelle/free/devm_free.cocci | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/scripts/coccinelle/free/devm_free.cocci b/scripts/coccinelle/free/devm_free.cocci
index 3794cd97494b..c990d2c7ee16 100644
--- a/scripts/coccinelle/free/devm_free.cocci
+++ b/scripts/coccinelle/free/devm_free.cocci
@@ -66,6 +66,10 @@ position p;
|
* kzfree@p(x)
|
+* __krealloc@p(x, ...)
+|
+* krealloc@p(x, ...)
+|
* free_pages@p(x, ...)
|
* free_page@p(x)
--
2.7.4
prev parent reply other threads:[~2016-05-23 15:51 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-23 15:07 [PATCH v2 0/3] coccinelle: catchup on memory allocation functions Yann Droneaud
2016-05-23 15:07 ` [PATCH v2 1/3] coccinelle: also catch kzfree() issues Yann Droneaud
2016-05-23 15:18 ` Julia Lawall
2016-06-20 13:24 ` Michal Marek
2016-06-20 20:21 ` Julia Lawall
2016-06-21 9:43 ` Michal Marek
2016-06-21 11:14 ` Yann Droneaud
2016-06-21 11:17 ` Julia Lawall
2016-05-23 15:07 ` [PATCH v2 2/3] coccinelle: recognize more devm_* memory allocation functions Yann Droneaud
2016-05-23 15:07 ` Yann Droneaud [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9a230c4f8a38b6a029bec56b7a005d2e2cd7a324.1464013817.git.ydroneaud@opteya.com \
--to=ydroneaud@opteya.com \
--cc=Gilles.Muller@lip6.fr \
--cc=Julia.Lawall@lip6.fr \
--cc=cocci@systeme.lip6.fr \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mmarek@suse.com \
--cc=nicolas.palix@imag.fr \
--cc=penberg@cs.helsinki.fi \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).