linux-kernel - Re: [RFT v2 1/3] ASoC: samsung: Fix possible double iounmap on s3c24xx driver probe failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 28 Jul 2017 10:09:29 +0530
From:   Arvind Yadav <arvind.yadav.cs@...il.com>
To:     Krzysztof Kozlowski <krzk@...nel.org>,
        Sangbeom Kim <sbkim73@...sung.com>,
        Sylwester Nawrocki <s.nawrocki@...sung.com>,
        Liam Girdwood <lgirdwood@...il.com>,
        Mark Brown <broonie@...nel.org>,
        Jaroslav Kysela <perex@...ex.cz>,
        Takashi Iwai <tiwai@...e.com>, alsa-devel@...a-project.org,
        linux-kernel@...r.kernel.org
Subject: Re: [RFT v2 1/3] ASoC: samsung: Fix possible double iounmap on
 s3c24xx driver probe failure



On Thursday 27 July 2017 10:43 PM, Krzysztof Kozlowski wrote:
> Commit 87b132bc0315 ("ASoC: samsung: s3c24{xx,12}-i2s: port to use
> generic dmaengine API") moved ioremap() call from
> s3c-i2s-v2.c:s3c_i2sv2_probe() to s3c2412-i2s.c:s3c2412_iis_dev_probe()
> and converted it to devm- resource managed interface.
>
> However the error path in first of them - s3c_i2sv2_probe() - was not
> updated.  If getting a iis clock in s3c_i2sv2_probe() failed, the
> address space would be unmapped there.  This could lead to:
> 1. double iounmap() later from devm-interface of s3c2412_iis_dev_probe()),
> 2. accessing the memory by other functions in s3c2412-i2s.c unit.
>
> Anyway, the owner of this mapped region should be s3c2412-i2s.c because
> it starts the mapping.
>
> Affected are drivers for S3C24xx family although issue was not reproduced.
>
> Fixes: 87b132bc0315 ("ASoC: samsung: s3c24{xx,12}-i2s: port to use generic dmaengine API")
> Signed-off-by: Krzysztof Kozlowski <krzk@...nel.org>
Acked-by: Arvind Yadav<arvind.yadav.cs@...il.com>
> ---
>
> Not marking as Cc-stable because this is theoretical problem, not
> reproduced and also not tested.
>
> Please, kindly test on S3C24xx hardware.
>
> Changes since v1:
> 1. None
> ---
>   sound/soc/samsung/s3c-i2s-v2.c | 1 -
>   1 file changed, 1 deletion(-)
>
> diff --git a/sound/soc/samsung/s3c-i2s-v2.c b/sound/soc/samsung/s3c-i2s-v2.c
> index ca522a95160b..9b28046eea8e 100644
> --- a/sound/soc/samsung/s3c-i2s-v2.c
> +++ b/sound/soc/samsung/s3c-i2s-v2.c
> @@ -634,7 +634,6 @@ int s3c_i2sv2_probe(struct snd_soc_dai *dai,
>   	i2s->iis_pclk = clk_get(dev, "iis");
>   	if (IS_ERR(i2s->iis_pclk)) {
>   		dev_err(dev, "failed to get iis_clock\n");
> -		iounmap(i2s->regs);
>   		return -ENOENT;
>   	}
>