linux-kernel - Re: [PATCH v2 2/2] pinctrl: pinmux: Add pinmux-select debugfs file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHp75VcDVVZ=hg5hfRTs9hJ20gdEE_Xhccyg859nsvtyxTXCyw@mail.gmail.com>
Date:   Wed, 10 Feb 2021 11:56:49 +0200
From:   Andy Shevchenko <andy.shevchenko@...il.com>
To:     Drew Fustini <drew@...gleboard.org>
Cc:     Linus Walleij <linus.walleij@...aro.org>,
        "open list:GPIO SUBSYSTEM" <linux-gpio@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Tony Lindgren <tony@...mide.com>,
        Alexandre Belloni <alexandre.belloni@...tlin.com>,
        Geert Uytterhoeven <geert@...ux-m68k.org>,
        Pantelis Antoniou <pantelis.antoniou@...sulko.com>,
        Jason Kridner <jkridner@...gleboard.org>,
        Robert Nelson <robertcnelson@...gleboard.org>
Subject: Re: [PATCH v2 2/2] pinctrl: pinmux: Add pinmux-select debugfs file

On Wed, Feb 10, 2021 at 9:50 AM Drew Fustini <drew@...gleboard.org> wrote:
>
> Add "pinmux-select" to debugfs which will activate a function and group
> when 2 integers "<function-selector> <group-selector>" are written to
> the file. The write operation pinmux_select() handles this by checking
> if fsel and gsel are valid selectors and then calling ops->set_mux().
>
> The existing "pinmux-functions" debugfs file lists the pin functions
> registered for the pin controller. For example:
>
> function: pinmux-uart0, groups = [ pinmux-uart0-pins ]
> function: pinmux-mmc0, groups = [ pinmux-mmc0-pins ]
> function: pinmux-mmc1, groups = [ pinmux-mmc1-pins ]
> function: pinmux-i2c0, groups = [ pinmux-i2c0-pins ]
> function: pinmux-i2c1, groups = [ pinmux-i2c1-pins ]
> function: pinmux-spi1, groups = [ pinmux-spi1-pins ]
>
> To activate function pinmux-i2c1 (fsel 4) and group pinmux-i2c1-pins
> (gsel 4):
>
> echo '4 4' > pinmux-select

...

>  DEFINE_SHOW_ATTRIBUTE(pinmux_pins);
>

> +

One blank line (existed) is enough.

> +#define PINMUX_MAX_NAME 64

...

> +       buf = devm_kzalloc(pctldev->dev, PINMUX_MAX_NAME * 2, GFP_KERNEL);

You have to (re-)read documentation about Device Managed Resources.
Keyword here is *device*! Pay attention to it. TL;DR: misuse of device
managed resources here.
Potentially memory exhausting (local DoS attack), but see below.

> +       if (!buf)
> +               return -ENOMEM;

...

> +       devm_kfree(pctldev->dev, buf);

Calling devm_kfree() or other devm_*() release kinda APIs is a red
flag in 99%. See above.

--
With Best Regards,
Andy Shevchenko