linux-kernel - Re: [PATCH RFC 1/3] spmi: Linux driver framework for SPMI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 16 Aug 2013 13:28:56 -0700
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	Josh Cartwright <joshc@...eaurora.org>
Cc:	Grant Likely <grant.likely@...aro.org>,
	Rob Herring <rob.herring@...xeda.com>,
	linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
	linux-arm-msm@...r.kernel.org,
	Sagar Dharia <sdharia@...eaurora.org>,
	Gilad Avidov <gavidov@...eaurora.org>,
	Michael Bohan <mbohan@...eaurora.org>
Subject: Re: [PATCH RFC 1/3] spmi: Linux driver framework for SPMI

On Fri, Aug 16, 2013 at 03:21:10PM -0500, Josh Cartwright wrote:
> On Fri, Aug 16, 2013 at 11:49:21AM -0700, Greg Kroah-Hartman wrote:
> > On Fri, Aug 09, 2013 at 01:37:09PM -0700, Josh Cartwright wrote:
> > > +++ b/drivers/spmi/spmi.c
> > > @@ -0,0 +1,449 @@
> [..]
> > > +static void spmi_ctrl_release(struct device *dev)
> > > +{
> > > +	struct spmi_controller *ctrl = to_spmi_controller(dev);
> > > +	complete(&ctrl->dev_released);
> > 
> > When is this memory going to be freed?
> > 
> > Ah, you think it will be when you remove the device later on:
> > 
> > > +int spmi_del_controller(struct spmi_controller *ctrl)
> > > +{
> > > +	struct spmi_controller *found;
> > > +
> > > +	if (!ctrl)
> > > +		return -EINVAL;
> > > +
> > > +	/* Check that the ctrl has been added */
> > > +	mutex_lock(&board_lock);
> > > +	found = idr_find(&ctrl_idr, ctrl->nr);
> > > +	mutex_unlock(&board_lock);
> > > +
> > > +	if (found != ctrl)
> > > +		return -EINVAL;
> > > +
> > > +	spmi_dfs_del_controller(ctrl);
> > > +
> > > +	/* Remove all the clients associated with this controller */
> > > +	mutex_lock(&board_lock);
> > > +	bus_for_each_dev(&spmi_bus_type, NULL, ctrl, spmi_ctrl_remove_device);
> > > +	idr_remove(&ctrl_idr, ctrl->nr);
> > > +	mutex_unlock(&board_lock);
> > > +
> > > +	init_completion(&ctrl->dev_released);
> > > +	device_unregister(&ctrl->dev);
> > > +	wait_for_completion(&ctrl->dev_released);
> > 
> > But you just leaked memory, right?
> > 
> > You should never have to wait for this to happen, why did you need to
> > add this?  Why not just a simple call to kfree() in the release
> > function?
> 
> Unfortunately, the reason why this was necessary may be lost to history.  :(
> 
> I'll do some testing with the completion removed and a simple kfree() in
> the release and see if there is any fallout.

There will be, you need to fix up the calling logic and the driver to
prevent memory that it thinks it still has access to, from going away
(that was my hint for the other patch you sent.)

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/