linux-kernel - Re: [PATCH] base: power: wakeirq: don't leak dev->power.wakeirq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 7 Jul 2015 03:11:20 -0500
From:	Felipe Balbi <balbi@...com>
To:	Tony Lindgren <tony@...mide.com>
CC:	"Rafael J. Wysocki" <rjw@...ysocki.net>,
	Felipe Balbi <balbi@...com>, <linux-pm@...r.kernel.org>,
	Linux OMAP Mailing List <linux-omap@...r.kernel.org>,
	Linux ARM Kernel Mailing List 
	<linux-arm-kernel@...ts.infradead.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] base: power: wakeirq: don't leak dev->power.wakeirq

On Tue, Jul 07, 2015 at 12:40:53AM -0700, Tony Lindgren wrote:
> * Rafael J. Wysocki <rjw@...ysocki.net> [150706 15:49]:
> > On Monday, July 06, 2015 01:01:18 PM Felipe Balbi wrote:
> > > on a first call to dev_pm_attach_wake_irq(), if it
> > > fails, it will leave dev->power.wakeirq set to a
> > > dangling pointer. Instead, let's clear it to make
> > > sure a subsequent call to dev_pm_attach_wake_irq()
> > > has chance to succeed.
> > > 
> > > Cc: Tony Lindgren <tmlind@...mide.com>
> > > Signed-off-by: Felipe Balbi <balbi@...com>
> > > ---
> > >  drivers/base/power/wakeirq.c | 9 ++++++++-
> > >  1 file changed, 8 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
> > > index 7470004ca810..394d250a1ad8 100644
> > > --- a/drivers/base/power/wakeirq.c
> > > +++ b/drivers/base/power/wakeirq.c
> > > @@ -50,9 +50,16 @@ static int dev_pm_attach_wake_irq(struct device *dev, int irq,
> > >  
> > >  	err = device_wakeup_attach_irq(dev, wirq);
> > >  	if (err)
> > > -		return err;
> > > +		goto err_cleanup;
> > >  
> > >  	return 0;
> > > +
> > > +err_cleanup:
> > > +	spin_lock_irqsave(&dev->power.lock, flags);
> > > +	dev->power.wakeirq = NULL;
> > > +	spin_unlock_irqrestore(&dev->power.lock, flags);
> > > +
> > > +	return err;
> > >  }
> > 
> > Too many labels for me and the fact that acquiring of the lock again in the error
> > patch doesn't look good.
> > 
> > However, we can do the entire device_wakeup_attach_irq() under the lock (after
> > removing the locking from it), because we're its only caller.
> > 
> > So what about the below instead (build-tested only)?
> 
> Nice, still works for me and simplifies things:
> 
> Tested-by: Tony Lindgren <tony@...mide.com>

Cool, thanks for testing Tony. Rafael, I'm fine with your version too.
FWIW:

Reported-by: Felipe Balbi <balbi@...com>

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)