linux-kernel - Re: [PATCH] firmware: arm_scmi: Fix leak in scmi_mailbox

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5135e6df-4977-bd97-95d9-300c12c9e073@arm.com>
Date:   Tue, 26 Mar 2019 11:59:16 +0000
From:   Steven Price <steven.price@....com>
To:     Mukesh Ojha <mojha@...eaurora.org>,
        Sudeep Holla <sudeep.holla@....com>,
        linux-arm-kernel@...ts.infradead.org
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [PATCH] firmware: arm_scmi: Fix leak in scmi_mailbox_check

On 26/03/2019 07:23, Mukesh Ojha wrote:
> 
> On 3/25/2019 11:07 PM, Steven Price wrote:
>> of_parse_phandle_with_args() requires the caller to call of_node_put() on
>> the returned args->np pointer. Otherwise the reference count will remain
>> incremented.
>>
>> However, in this case, since we don't actually use the returned pointer,
>> we can simply pass in NULL.
>>
>> Fixes: aa4f886f3893f ("firmware: arm_scmi: add basic driver
>> infrastructure for SCMI")
>> Signed-off-by: Steven Price <steven.price@....com>
>> ---
>>   drivers/firmware/arm_scmi/driver.c | 4 +---
>>   1 file changed, 1 insertion(+), 3 deletions(-)
>>
>> diff --git a/drivers/firmware/arm_scmi/driver.c
>> b/drivers/firmware/arm_scmi/driver.c
>> index 8f952f2f1a29..dd967d675c08 100644
>> --- a/drivers/firmware/arm_scmi/driver.c
>> +++ b/drivers/firmware/arm_scmi/driver.c
>> @@ -654,9 +654,7 @@ static int scmi_xfer_info_init(struct scmi_info
>> *sinfo)
>>     static int scmi_mailbox_check(struct device_node *np)
>>   {
>> -    struct of_phandle_args arg;
>> -
>> -    return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0,
>> &arg);
>> +    return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0,
>> NULL);
> 
> Although, it is not used but it is better to put arg->np instead of
> passing NULL.
> Here, you are making the driver not to fill arguement which is
> customised solution, that may change in future.

The function of_parse_phandle_with_args() is documented thus:

>  * of_parse_phandle_with_args() - Find a node pointed by phandle in a list
>  * @np:		pointer to a device tree node containing a list
>  * @list_name:	property name that contains a list
>  * @cells_name:	property name that specifies phandles' arguments count
>  * @index:	index of a phandle to parse out
>  * @out_args:	optional pointer to output arguments structure (will be filled)

So I'm going by the documentation (and implementation) which both
consider out_args to be optional. The alternative is of course:

> diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
> index 8f952f2f1a29..aa6c0728e676 100644
> --- a/drivers/firmware/arm_scmi/driver.c
> +++ b/drivers/firmware/arm_scmi/driver.c
> @@ -655,8 +655,11 @@ static int scmi_xfer_info_init(struct scmi_info *sinfo)
>  static int scmi_mailbox_check(struct device_node *np)
>  {
>  	struct of_phandle_args arg;
> +	int ret;
>  
> -	return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, &arg);
> +	ret = of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, &arg);
> +	of_node_put(arg->np);
> +	return ret;
>  }
>  
>  static int scmi_mbox_free_channel(int id, void *p, void *data)

But personally that doesn't seem as good. Is there any reason to think
the interface of of_parse_phandle_with_args() will change?

Steve