linux-kernel - Re: [PATCH] bus: vexpress-config: Add missing of_node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.10.1601251323190.2510@hadrien>
Date:	Mon, 25 Jan 2016 13:24:44 +0100 (CET)
From:	Julia Lawall <julia.lawall@...6.fr>
To:	liviu.dudau@....com
cc:	Amitoj Kaur Chawla <amitoj1606@...il.com>, sudeep.holla@....com,
	lorenzo.pieralisi@....com, linux-kernel@...r.kernel.org,
	linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH] bus: vexpress-config: Add missing of_node_put



On Mon, 25 Jan 2016, liviu.dudau@....com wrote:

> On Fri, Jan 22, 2016 at 11:38:38PM +0530, Amitoj Kaur Chawla wrote:
> > for_each_compatible_node performs an of_node_get on each iteration, so
> > to break out of the loop an of_node_put is required.
> >
> > Found using Coccinelle. The semantic patch used for this is as follows:
> >
> > // <smpl>
> > @@
> > expression e;
> > local idexpression n;
> > @@
> >
> >  for_each_compatible_node(n, ...) {
> >    ... when != of_node_put(n)
> >        when != e = n
> > (
> >    return n;
> > +  of_node_put(n);
> > ?  return ...;
> > )
> >    ...
> >  }
> > // </smpl>
> >
> > Signed-off-by: Amitoj Kaur Chawla <amitoj1606@...il.com>
>
> Hi Amitoj,
>
> > ---
> >  drivers/bus/vexpress-config.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/bus/vexpress-config.c b/drivers/bus/vexpress-config.c
> > index 6575c0f..c3cb76b 100644
> > --- a/drivers/bus/vexpress-config.c
> > +++ b/drivers/bus/vexpress-config.c
> > @@ -192,8 +192,10 @@ static int __init vexpress_config_init(void)
> >  	/* Need the config devices early, before the "normal" devices... */
> >  	for_each_compatible_node(node, NULL, "arm,vexpress,config-bus") {
> >  		err = vexpress_config_populate(node);
> > -		if (err)
> > +		if (err) {
> > +			of_node_put(node);
> >  			break;
> > +		}
>
> This automatically generated patch only solves half of the problem (for the error
> path).
>
> >  	}
> >
> >  	return err;
> > --
> > 1.9.1
> >
>
> I feel that a better patch would be the following, where the node is released
> regardless of the result of vexpress_config_populate().
>
> --8<--------------------------------------------------------------------------
> diff --git a/drivers/bus/vexpress-config.c b/drivers/bus/vexpress-config.c
> index 6575c0f..c57453d 100644
> --- a/drivers/bus/vexpress-config.c
> +++ b/drivers/bus/vexpress-config.c
> @@ -192,6 +192,7 @@ static int __init vexpress_config_init(void)
>  	/* Need the config devices early, before the "normal" devices... */
>  	for_each_compatible_node(node, NULL, "arm,vexpress,config-bus") {
>  		err = vexpress_config_populate(node);
> +		of_node_put(node);

This is not correct.  for_each_compatible_node will do the free if you go
around the loop.  This change would lead to a double free in the non error
case.

julia

>  		if (err)
>  			break;
>  	}
> -->8--------------------------------------------------------------------------
>
> Best regards,
> Liviu
>
> --
> ====================
> | I would like to |
> | fix the world,  |
> | but they're not |
> | giving me the   |
>  \ source code!  /
>   ---------------
>     ¯\_(ツ)_/¯
>