linux-kernel - Re: [PATCH v5 13/19] remoteproc: Properly deal with the resource table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210215120603.GF2087@kadam>
Date:   Mon, 15 Feb 2021 15:06:03 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Mathieu Poirier <mathieu.poirier@...aro.org>,
        ohad@...ery.com, bjorn.andersson@...aro.org,
        arnaud.pouliquen@...com
Cc:     lkp@...el.com, kbuild-all@...ts.01.org, robh+dt@...nel.org,
        mcoquelin.stm32@...il.com, alexandre.torgue@...com,
        linux-remoteproc@...r.kernel.org, devicetree@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH v5 13/19] remoteproc: Properly deal with the resource
 table

Hi Mathieu,

url:    https://github.com/0day-ci/linux/commits/Mathieu-Poirier/remoteproc-Add-support-for-detaching-a-remote-processor/20210212-075607
base:   https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git for-next
config: ia64-randconfig-m031-20210209 (attached as .config)
compiler: ia64-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

smatch warnings:
drivers/remoteproc/remoteproc_core.c:2080 rproc_detach() error: double free of 'rproc->cached_table'

vim +2080 drivers/remoteproc/remoteproc_core.c

eab58da78fe46f Mathieu Poirier 2021-02-11  2069  	/* clean up all acquired resources */
eab58da78fe46f Mathieu Poirier 2021-02-11  2070  	rproc_resource_cleanup(rproc);
eab58da78fe46f Mathieu Poirier 2021-02-11  2071  
eab58da78fe46f Mathieu Poirier 2021-02-11  2072  	/* release HW resources if needed */
eab58da78fe46f Mathieu Poirier 2021-02-11  2073  	rproc_unprepare_device(rproc);
eab58da78fe46f Mathieu Poirier 2021-02-11  2074  
eab58da78fe46f Mathieu Poirier 2021-02-11  2075  	rproc_disable_iommu(rproc);
eab58da78fe46f Mathieu Poirier 2021-02-11  2076  
66e2fed7a4bb20 Mathieu Poirier 2021-02-11  2077  	/* Free the copy of the resource table */
66e2fed7a4bb20 Mathieu Poirier 2021-02-11  2078  	kfree(rproc->cached_table);
                                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^
eab58da78fe46f Mathieu Poirier 2021-02-11  2079  	/* Follow the same sequence as in rproc_shutdown() */
eab58da78fe46f Mathieu Poirier 2021-02-11 @2080  	kfree(rproc->cached_table);
                                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^
Double free.

eab58da78fe46f Mathieu Poirier 2021-02-11  2081  	rproc->cached_table = NULL;
66e2fed7a4bb20 Mathieu Poirier 2021-02-11  2082  	rproc->clean_table = NULL;
eab58da78fe46f Mathieu Poirier 2021-02-11  2083  	rproc->table_ptr = NULL;
66e2fed7a4bb20 Mathieu Poirier 2021-02-11  2084  
eab58da78fe46f Mathieu Poirier 2021-02-11  2085  out:
eab58da78fe46f Mathieu Poirier 2021-02-11  2086  	mutex_unlock(&rproc->lock);
eab58da78fe46f Mathieu Poirier 2021-02-11  2087  	return ret;
eab58da78fe46f Mathieu Poirier 2021-02-11  2088  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

Download attachment ".config.gz" of type "application/gzip" (31951 bytes)