linux-kernel - Re: [PATCH] iio:imu:bmi160: disable regulator in error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 19 Mar 2022 16:20:06 +0000
From:   Jonathan Cameron <jic23@...nel.org>
To:     Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
Cc:     Tong Zhang <ztong0001@...il.com>,
        Lars-Peter Clausen <lars@...afoo.de>,
        Linus Walleij <linus.walleij@...aro.org>,
        Alexandru Ardelean <ardeleanalex@...il.com>,
        Jonathan Albrieux <jonathan.albrieux@...il.com>,
        linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] iio:imu:bmi160: disable regulator in error path

On Fri, 18 Mar 2022 16:11:55 +0200
Andy Shevchenko <andriy.shevchenko@...ux.intel.com> wrote:

> On Fri, Mar 18, 2022 at 12:09:00AM -0700, Tong Zhang wrote:
> > regulator should be disabled in error path as mentioned in _regulator_put()
> > 
> > [   16.233604] WARNING: CPU: 0 PID: 2177 at drivers/regulator/core.c:2257 _regulator_put
> > [   16.240453] Call Trace:
> > [   16.240572]  <TASK>
> > [   16.240676]  regulator_put+0x26/0x40
> > [   16.240853]  regulator_bulk_free+0x26/0x50
> > [   16.241050]  release_nodes+0x3f/0x70
> > [   16.241225]  devres_release_group+0x147/0x1c0
> > [   16.241441]  ? bmi160_core_probe+0x175/0x3a0 [bmi160_core]  
> 
> Seems legit. Currently we call it only when something else is failed afterwards.
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>

Indeed this is fixing a real issue, but only one of two similar issues.
(I'd never have looked closely at this code without you spotting the first one :)

If I were writing this driver from scratch I would register
multiple devm_add_action_or_reset() callbacks and I note that even though
we might have turned the power off we haven't handled the other state
set in this init function.

1) Regulator disable.
2) bmi160_set_mode(bmi_data, BMI160_GYRO, false);
3) bmi160_set_mode(bmi_data, BMI160_ACCEL, false);

An alternative is to add handling for the first set_mode() in here being
unwound if the second fails.  See below.  

> 
> > Fixes: 5dea3fb066f0 ("iio: imu: bmi160: added regulator support")
> > Signed-off-by: Tong Zhang <ztong0001@...il.com>
> > ---
> >  drivers/iio/imu/bmi160/bmi160_core.c | 17 +++++++++++------
> >  1 file changed, 11 insertions(+), 6 deletions(-)
> > 
> > diff --git a/drivers/iio/imu/bmi160/bmi160_core.c b/drivers/iio/imu/bmi160/bmi160_core.c
> > index 824b5124a5f5..f12446edb5ce 100644
> > --- a/drivers/iio/imu/bmi160/bmi160_core.c
> > +++ b/drivers/iio/imu/bmi160/bmi160_core.c
> > @@ -730,7 +730,7 @@ static int bmi160_chip_init(struct bmi160_data *data, bool use_spi)
> >  
> >  	ret = regmap_write(data->regmap, BMI160_REG_CMD, BMI160_CMD_SOFTRESET);
> >  	if (ret)
> > -		return ret;
> > +		goto disable_regulator;
> >  
> >  	usleep_range(BMI160_SOFTRESET_USLEEP, BMI160_SOFTRESET_USLEEP + 1);
> >  
> > @@ -741,29 +741,34 @@ static int bmi160_chip_init(struct bmi160_data *data, bool use_spi)
> >  	if (use_spi) {
> >  		ret = regmap_read(data->regmap, BMI160_REG_DUMMY, &val);
> >  		if (ret)
> > -			return ret;
> > +		goto disable_regulator;
> >  	}
> >  
> >  	ret = regmap_read(data->regmap, BMI160_REG_CHIP_ID, &val);
> >  	if (ret) {
> >  		dev_err(dev, "Error reading chip id\n");
> > -		return ret;
> > +		goto disable_regulator;
> >  	}
> >  	if (val != BMI160_CHIP_ID_VAL) {
> >  		dev_err(dev, "Wrong chip id, got %x expected %x\n",
> >  			val, BMI160_CHIP_ID_VAL);
> > -		return -ENODEV;
> > +		ret = -ENODEV;
> > +		goto disable_regulator;
> >  	}
> >  
> >  	ret = bmi160_set_mode(data, BMI160_ACCEL, true);
> >  	if (ret)
> > -		return ret;
> > +		goto disable_regulator;
> >  
> >  	ret = bmi160_set_mode(data, BMI160_GYRO, true);
> >  	if (ret)

If this fails, we should also undo the previous call as well. For readability
use goto disable_accel; then fix it under that new label.
 
> > -		return ret;
> > +		goto disable_regulator;
> >  
> >  	return 0;
> > +
> > +disable_regulator:
> > +	regulator_bulk_disable(ARRAY_SIZE(data->supplies), data->supplies);
> > +	return ret;
> >  }
> >  
> >  static int bmi160_data_rdy_trigger_set_state(struct iio_trigger *trig,
> > -- 
> > 2.25.1
> >   
>