linux-kernel - Re: [REGRESSION] component: add support for releasing match data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Jan 2016 14:48:56 +0000
From:	Russell King - ARM Linux <linux@....linux.org.uk>
To:	Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Intel Graphics Development <intel-gfx@...ts.freedesktop.org>
Subject: Re: [REGRESSION] component: add support for releasing match data

On Tue, Jan 26, 2016 at 03:28:34PM +0100, Maarten Lankhorst wrote:
> Something similar to a segfault. It's trying to call 0x6b6b6b6b6b which
> is POISON_FREE.
> 
> mc appears to be freed already, so calling mc->release would jump to
> invalid data.

It seems that my devm foo wasn't quite up to scratch.  Quite why it
doesn't show here while testing it (I have patches for the etnaviv
GPU driver, which I'm regularly inserting/removing) I'm not sure.

Please test this patch - it seems "no worse" for me (in that it didn't
crash before, and it still doesn't crash.)

Thanks.

 drivers/base/component.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/base/component.c b/drivers/base/component.c
index 89f5cf68d80a..05cd26c02449 100644
--- a/drivers/base/component.c
+++ b/drivers/base/component.c
@@ -206,6 +206,8 @@ static void component_match_release(struct device *master,
 		if (mc->release)
 			mc->release(master, mc->data);
 	}
+
+	kfree(match->compare);
 }
 
 static void devm_component_match_release(struct device *dev, void *res)
@@ -221,14 +223,14 @@ static int component_match_realloc(struct device *dev,
 	if (match->alloc == num)
 		return 0;
 
-	new = devm_kmalloc_array(dev, num, sizeof(*new), GFP_KERNEL);
+	new = kmalloc_array(num, sizeof(*new), GFP_KERNEL);
 	if (!new)
 		return -ENOMEM;
 
 	if (match->compare) {
 		memcpy(new, match->compare, sizeof(*new) *
 					    min(match->num, num));
-		devm_kfree(dev, match->compare);
+		kfree(match->compare);
 	}
 	match->compare = new;
 	match->alloc = num;


-- 
RMK's Patch system: http://www.arm.linux.org.uk/developer/patches/
FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up
according to speedtest.net.