linux-kernel - Re: [RFC PATCH 2/2] mmc: add OpenFirmware bindings for the mmc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080526115826.GB26288@polina.dev.rtsoft.ru>
Date:	Mon, 26 May 2008 15:58:26 +0400
From:	Anton Vorontsov <avorontsov@...mvista.com>
To:	Stephen Rothwell <sfr@...b.auug.org.au>
Cc:	Pierre Ossman <drzeus-mmc@...eus.cx>,
	David Brownell <dbrownell@...rs.sourceforge.net>,
	Grant Likely <grant.likely@...retlab.ca>,
	linuxppc-dev@...abs.org, Gary Jennejohn <garyj@...x.de>,
	Guennadi Liakhovetski <g.liakhovetski@....de>,
	linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH 2/2] mmc: add OpenFirmware bindings for the mmc_spi
	driver

On Sat, May 24, 2008 at 12:35:27PM +1000, Stephen Rothwell wrote:
> Hi Anton,
> 
> On Fri, 23 May 2008 22:28:42 +0400 Anton Vorontsov <avorontsov@...mvista.com> wrote:
> >
> > +++ b/drivers/mmc/host/of_mmc_spi.c
> 
> > +static int of_mmc_spi_probe(struct spi_device *spi)
> 
> > +	/*
> > +	 * mmc_spi_probe will use drvdata, so we can't use it. Use node's
> > +	 * data instead.
> > +	 */
> > +	spi->dev.archdata.of_node->data = oms;
> 
> If you delay this assignment, you may not have to clean it up in the
> error path.

No, if I delay it I'll have to clean it up anyway, just a bit later
(after mmc_spi_probe() fail).

> > +	ocr_mask = of_get_property(np, "linux,mmc-ocr-mask", &size);
> 
> You should really explicitly include linux/of.h to use of_get_property etc

Thanks, will do.

> > +int __devexit of_mmc_spi_remove(struct spi_device *spi)
> > +{
> > +	struct of_mmc_spi *oms = spi->dev.archdata.of_node->data;
> > +	int ret;
> > +
> > +	ret = mmc_spi_remove(spi);
> > +	if (ret)
> > +		return ret;
> 
> Maybe you should do this last so that you don't leak more than necessary
> if mmc_spi_remove fails. (I don't know what state mmc_spi_remove leaves
> stuff in if it fails ...)

If I do this last, then of_mmc_spi_remove() would be not safe to call
multiple times on non-fatal errors (e.g. when mmc_spi_remove() returns
-EBUSY (despite that currently mmc_spi_remove can't fail)).

Also, if I do this last, then there will be a potential use-after-free
in the mmc_spi driver.

> > +static struct spi_driver of_mmc_spi_driver = {
> > +	.driver = {
> > +		.name = "of_mmc_spi",
> > +		.bus = &spi_bus_type,
> 
> This is initialised by spi_register_driver().

This was straight copy from the mmc_spi.c. Will fix.

Thanks,

-- 
Anton Vorontsov
email: cbouatmailru@...il.com
irc://irc.freenode.net/bd2
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/