linux-kernel - Re: [PATCH] ACPI: only free map once in osl.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJwJo6ZTSw93zKdN3i-YqVtEEwh4qWc22Hk-emHvJth+HsaQbQ@mail.gmail.com>
Date:   Thu, 21 Nov 2019 21:19:43 +0000
From:   Dmitry Safonov <0x7f454c46@...il.com>
To:     Francesco Ruggeri <fruggeri@...sta.com>
Cc:     lenb@...nel.org, "Rafael J. Wysocki" <rjw@...ysocki.net>,
        open list <linux-kernel@...r.kernel.org>,
        linux-acpi@...r.kernel.org
Subject: Re: [PATCH] ACPI: only free map once in osl.c

Hi Francesco,

I believe, there's still an issue with your patch.

On Wed, 20 Nov 2019 at 05:50, Francesco Ruggeri <fruggeri@...sta.com> wrote:
> @@ -472,10 +477,11 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas)
>                 mutex_unlock(&acpi_ioremap_lock);
>                 return;
>         }
> -       acpi_os_drop_map_ref(map);
> +       refcount = acpi_os_drop_map_ref(map);
>         mutex_unlock(&acpi_ioremap_lock);

Here comes acpi_os_get_iomem() increasing the refcount again.

>
> -       acpi_os_map_cleanup(map);
> +       if (!refcount)
> +               acpi_os_map_cleanup(map);
>  }
>  EXPORT_SYMBOL(acpi_os_unmap_generic_address);

And you free the acpi_ioremap that's being used:

>  static void acpi_os_map_cleanup(struct acpi_ioremap *map)
>  {
> -       if (!map->refcount) {
> -               synchronize_rcu_expedited();
> -               acpi_unmap(map->phys, map->virt);
> -               kfree(map);
> -       }
> +       synchronize_rcu_expedited();
> +       acpi_unmap(map->phys, map->virt);
> +       kfree(map);
>  }

Thanks,
             Dmitry