linux-kernel - Re: [PATCH net v5 2/4] dpll: fix pin dump crash for rebound module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 18 Jan 2024 12:44:06 +0100
From: Jiri Pirko <jiri@...nulli.us>
To: Arkadiusz Kubalewski <arkadiusz.kubalewski@...el.com>
Cc: netdev@...r.kernel.org, vadim.fedorenko@...ux.dev, davem@...emloft.net,
	milena.olech@...el.com, linux-kernel@...r.kernel.org,
	pabeni@...hat.com, kuba@...nel.org, mschmidt@...hat.com,
	Jan Glaza <jan.glaza@...el.com>,
	Przemek Kitszel <przemyslaw.kitszel@...el.com>
Subject: Re: [PATCH net v5 2/4] dpll: fix pin dump crash for rebound module

Thu, Jan 18, 2024 at 12:07:17PM CET, arkadiusz.kubalewski@...el.com wrote:

[...]

>@@ -443,7 +490,9 @@ dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module *module,
> 		ret = -EINVAL;
> 		goto err_pin_prop;
> 	}
>-	pin->prop = prop;
>+	ret = dpll_pin_prop_dup(prop, &pin->prop);
>+	if (ret)
>+		goto err_pin_prop;
> 	refcount_set(&pin->refcount, 1);
> 	xa_init_flags(&pin->dpll_refs, XA_FLAGS_ALLOC);
> 	xa_init_flags(&pin->parent_refs, XA_FLAGS_ALLOC);

You are missing dpll_pin_prop_free() call on error path. It should go
right above "err_pin_prop:" line.

Haste makes waste..

pw-bot: cr



>@@ -515,6 +564,7 @@ void dpll_pin_put(struct dpll_pin *pin)
> 		xa_destroy(&pin->dpll_refs);
> 		xa_destroy(&pin->parent_refs);
> 		xa_erase(&dpll_pin_xa, pin->id);
>+		dpll_pin_prop_free(&pin->prop);

To be symmetric with dpll_pin_alloc() order, xa_erase() should be called
first here and xa_destroys() in different order. But that is a material
for net-next.



> 		kfree(pin);
> 	}
> 	mutex_unlock(&dpll_lock);

[...]