linux-kernel - Re: [V2] mtd: devices: docg3:- Handle return value of devm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 12 Dec 2016 21:33:05 +0530
From:   arvind Yadav <arvind.yadav.cs@...il.com>
To:     Boris Brezillon <boris.brezillon@...e-electrons.com>
Cc:     robert.jarzmik@...e.fr, dwmw2@...radead.org,
        computersforpeace@...il.com, marek.vasut@...il.com, richard@....at,
        cyrille.pitchen@...el.com, linux-mtd@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: Re: [V2] mtd: devices: docg3:- Handle return value of devm_ioremap.

There is problem, if you will use devm_ioremap_resource instead of 
devm_ioremap,
than devm_ioremap_resource will call request_mem_region().
request_mem_region() allows to tell the kernel that this driver is going 
to use
this range of I/O addresses, which will prevent other drivers to make an
overlapping call to request_mem_region If other driver want to use same 
address
space to access then it will not allow. Means we can not share same 
address space
between two driver.

Thanks
-Arvind

On Monday 12 December 2016 02:12 PM, Boris Brezillon wrote:
> On Mon, 12 Dec 2016 08:30:04 +0530
> Arvind Yadav <arvind.yadav.cs@...il.com> wrote:
>
>> Here, If devm_ioremap will fail. It will return NULL.
>> Kernel can run into a NULL-pointer dereference.
>>
>> Signed-off-by: Arvind Yadav <arvind.yadav.cs@...il.com>
>> ---
>>   drivers/mtd/devices/docg3.c | 7 ++++++-
>>   1 file changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
>> index b833e6c..ffe3db0 100644
>> --- a/drivers/mtd/devices/docg3.c
>> +++ b/drivers/mtd/devices/docg3.c
>> @@ -2083,9 +2083,14 @@ static int __init docg3_probe(struct platform_device *pdev)
>>   		dev_err(dev, "No I/O memory resource defined\n");
>>   		return ret;
>>   	}
>> -	base = devm_ioremap(dev, ress->start, DOC_IOSPACE_SIZE);
>>   
>>   	ret = -ENOMEM;
>> +	base = devm_ioremap(dev, ress->start, DOC_IOSPACE_SIZE);
>> +	if (!base) {
>> +		dev_err(dev, "failed to map I/O memory\n");
>> +		return ret;
>> +	}
>> +
>>   	cascade = devm_kzalloc(dev, sizeof(*cascade) * DOC_MAX_NBFLOORS,
>>   			       GFP_KERNEL);
>>   	if (!cascade)
> How about going even further and doing the following?
> This way you can drop the test on rres (it's done for you in
> devm_ioremap_resource()), and you can directly return the error
> returned by devm_ioremap_resource().
>
> --->8---
> diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
> index b833e6cc684c..c59b91734344 100644
> --- a/drivers/mtd/devices/docg3.c
> +++ b/drivers/mtd/devices/docg3.c
> @@ -2077,13 +2077,10 @@ static int __init docg3_probe(struct
> platform_device *pdev) int ret, floor;
>          struct docg3_cascade *cascade;
>   
> -       ret = -ENXIO;
>          ress = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> -       if (!ress) {
> -               dev_err(dev, "No I/O memory resource defined\n");
> -               return ret;
> -       }
> -       base = devm_ioremap(dev, ress->start, DOC_IOSPACE_SIZE);
> +       base = devm_ioremap_resource(dev, ress);
> +       if (IS_ERR(base))
> +               return PTR_ERR(base);
>   
>          ret = -ENOMEM;
>          cascade = devm_kzalloc(dev, sizeof(*cascade) * DOC_MAX_NBFLOORS,