linux-kernel - Re: [PATCH] PM: Fix dev_pm_put_subsys_data() to not call kfree() while holding device power lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130504125116.GA13770@amd.pavel.ucw.cz>
Date:	Sat, 4 May 2013 14:51:16 +0200
From:	Pavel Machek <pavel@....cz>
To:	Shuah Khan <shuah.kh@...sung.com>
Cc:	"len.brown@...el.com" <len.brown@...el.com>,
	"rafael.j.wysocki@...el.com" <rafael.j.wysocki@...el.com>,
	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
	"linux-pm@...r.kernel.org" <linux-pm@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"shuahkhan@...il.com" <shuahkhan@...il.com>
Subject: Re: [PATCH] PM: Fix dev_pm_put_subsys_data() to not call kfree()
 while holding device power lock

Hi!

> dev_pm_put_subsys_data() calls kfree() while holding device power lock, when
> the reference count is 0. Fix it to call kfree() after releasing the lock.
> 
> Signed-off-by: Shuah Khan <shuah.kh@...sung.com>
> ---
>  drivers/base/power/common.c |    6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
w> diff --git a/drivers/base/power/common.c b/drivers/base/power/common.c
> index 39c3252..da05fe2 100644
> --- a/drivers/base/power/common.c
> +++ b/drivers/base/power/common.c
> @@ -73,13 +73,17 @@ int dev_pm_put_subsys_data(struct device *dev)
>  
>  	if (--psd->refcount == 0) {
>  		dev->power.subsys_data = NULL;
> -		kfree(psd);
>  		ret = 1;
>  	}
>  
>   out:
>  	spin_unlock_irq(&dev->power.lock);
>  
> +	if (ret == 1) {
> +		/* kfree() verifies that its argument is nonzero. */
> +		kfree(psd);
> +	}
> +
>  	return ret;
>  }

Wow, that function is fragile. It returns 0/1/-EINVAL, while being
documented for 0/1...

Patch does not look obviously wrong, but maybe 

@@ -73,13 +73,17 @@ int dev_pm_put_subsys_data(struct device *dev)
 
 	if (--psd->refcount == 0) {
 		dev->power.subsys_data = NULL;
+		spin_unlock_irq(&dev->power.lock);
-		kfree(psd);
- 		ret = 1;
+		return 1;
 	}

Would be cleaner.
									Pavel


-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/