linux-kernel - Re: [PATCH v3] soc: qcom: apr: Add check and kfree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 13 Sep 2022 11:33:55 -0700
From:   Jeff Johnson <quic_jjohnson@...cinc.com>
To:     Jiasheng Jiang <jiasheng@...as.ac.cn>, <agross@...nel.org>,
        <bjorn.andersson@...aro.org>, <konrad.dybcio@...ainline.org>
CC:     <linux-arm-msm@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v3] soc: qcom: apr: Add check and kfree

On 9/13/2022 1:06 AM, Jiasheng Jiang wrote:
> As idr_alloc() and of_property_read_string_index can return negative
> numbers, it should be better to check the return value and deal with
> the exception.
> Moreover, if device_register() fails, the adev should also be freed in
> order to avoid memory leak.
> Therefore, it should be better to use goto statement to deal with the
> exception.
> 
> Fixes: 6adba21eb434 ("soc: qcom: Add APR bus driver")
> Signed-off-by: Jiasheng Jiang <jiasheng@...as.ac.cn>
> ---
> Changelog:
> 
> v2 -> v3:
> 
> 1. Change the title and use goto statement to deal with the exception.
> 
> v1 -> v2:
> 
> 1. Add dev_err and put_device in order to maintain the code consistency.
> ---
>   drivers/soc/qcom/apr.c | 22 ++++++++++++++++++----
>   1 file changed, 18 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/soc/qcom/apr.c b/drivers/soc/qcom/apr.c
> index b4046f393575..b1a197155b2d 100644
> --- a/drivers/soc/qcom/apr.c
> +++ b/drivers/soc/qcom/apr.c
> @@ -454,20 +454,34 @@ static int apr_add_device(struct device *dev, struct device_node *np,
>   	adev->dev.driver = NULL;
>   
>   	spin_lock(&apr->svcs_lock);
> -	idr_alloc(&apr->svcs_idr, svc, svc_id, svc_id + 1, GFP_ATOMIC);
> +	ret = idr_alloc(&apr->svcs_idr, svc, svc_id, svc_id + 1, GFP_ATOMIC);
>   	spin_unlock(&apr->svcs_lock);
> +	if (ret < 0) {
> +		dev_err(dev, "idr_alloc failed: %d\n", ret);
> +		goto error;
> +	}
>   
> -	of_property_read_string_index(np, "qcom,protection-domain",
> -				      1, &adev->service_path);
> +	ret = of_property_read_string_index(np, "qcom,protection-domain",
> +					    1, &adev->service_path);
> +	if (ret < 0) {
> +		dev_err(dev, "of_property_read_string_index failed: %d\n", ret);
> +		goto error;
> +	}
>   
>   	dev_info(dev, "Adding APR/GPR dev: %s\n", dev_name(&adev->dev));
>   
>   	ret = device_register(&adev->dev);
>   	if (ret) {
>   		dev_err(dev, "device_register failed: %d\n", ret);
> -		put_device(&adev->dev);
> +		goto error;
>   	}
>   
> +	goto end;
> +
> +error:
> +	put_device(&adev->dev);
> +	kfree(adev);

isn't this a double free since put_device() will free adev?

> +end:
>   	return ret;
>   }
>