linux-kernel - Re: [PATCH] of: Deep-copy names of platform devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 12 Aug 2014 11:12:26 -0500
From:	Kumar Gala <galak@...eaurora.org>
To:	Stepan Moskovchenko <stepanm@...eaurora.org>
Cc:	grant.likely@...aro.org, Rob Herring <rob.herring@...xeda.com>,
	devicetree-discuss@...ts.ozlabs.org, linux-kernel@...r.kernel.org,
	linux-arm-msm@...r.kernel.org
Subject: Re: [PATCH] of: Deep-copy names of platform devices


On Aug 11, 2014, at 9:42 PM, Stepan Moskovchenko <stepanm@...eaurora.org> wrote:

> When we parse the device tree and allocate platform
> devices, the 'name' of the newly-created platform_device
> is set to point to the 'name' field of the 'struct device'
> embedded within the platform_device. This is dangerous,
> because the name of the 'struct device' is dynamically
> allocated. Drivers may call dev_set_name() on the device,
> which will free and reallocate the name of the device,
> leaving the 'name' of the platform_device pointing to the
> now-freed memory.
> 
> Furthermore, if the dev_set_name() call is made from a
> driver's probe() function and a subsequent request results
> in probe deferral, the dangling 'name' reference may lead
> to the device being re-probed using the wrong driver.
> 
> To mitigate these scenarios, we use kstrdup to perform a
> deep copy of the device name when assigning the name of the
> platform_device, so that the platform_device name is
> unaffected by any calls to dev_set_name() that might made
> by drivers to rename the embedded 'struct device'.
> 
> Signed-off-by: Stepan Moskovchenko <stepanm@...eaurora.org>
> ---
> I suppose creating a 'pdev_set_name' API may seem like
> another possibility, but I feel that dev.name and pdev.name
> have two different meanings. One is used for device/driver
> binding purposes, whereas the other serves a more general
> identification purpose, and is used for things like sysfs.
> Drivers might want to change dev.name while leaving the
> pdev.name alone. I guess yet another possibility would be
> to prohibit calling dev_set_name() on devices created from
> device tree, but a driver does not necessarily know how a
> given platform_device was allocated.
> 
> drivers/of/device.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/of/device.c b/drivers/of/device.c
> index f685e55..fe5f025 100644
> --- a/drivers/of/device.c
> +++ b/drivers/of/device.c
> @@ -54,7 +54,7 @@ int of_device_add(struct platform_device *ofdev)
> 
> 	/* name and id have to be set so that the platform bus doesn't get
> 	 * confused on matching */
> -	ofdev->name = dev_name(&ofdev->dev);
> +	ofdev->name = kstrdup(dev_name(&ofdev->dev), GFP_KERNEL);
> 	ofdev->id = -1;
> 
> 	/* device_add will assume that this device is on the same node as

Don’t we need to free this is of_device_unregister() now?

- k

> --
> The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
> hosted by The Linux Foundation
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-arm-msm" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

-- 
Employee of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, hosted by The Linux Foundation

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/