linux-kernel - Re: [PATCH v2 1/2] EDAC/device_sysfs: Fix calling kobject_put() with ->state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240125130936.GYZbJdkFOQds9w0hAp@fat_crate.local>
Date: Thu, 25 Jan 2024 14:09:36 +0100
From: Borislav Petkov <bp@...en8.de>
To: Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>
Cc: Tony Luck <tony.luck@...el.com>, James Morse <james.morse@....com>,
	Mauro Carvalho Chehab <mchehab@...nel.org>,
	Robert Richter <rric@...nel.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	linux-edac@...r.kernel.org, linux-kernel@...r.kernel.org,
	dan.carpenter@...aro.org, kernel-janitors@...r.kernel.org,
	error27@...il.com, stable@...r.kernel.org
Subject: Re: [PATCH v2 1/2] EDAC/device_sysfs: Fix calling kobject_put() with
 ->state_initialized unset

On Tue, Nov 28, 2023 at 10:30:35AM -0800, Harshit Mogalapalli wrote:
> In edac_device_register_sysfs_main_kobj(), when dev_root is NULL,

When is dev_root NULL?

A real use case or this is just from code staring?

> diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
> index 010c26be5846..4cac14cbdb60 100644
> --- a/drivers/edac/edac_device_sysfs.c
> +++ b/drivers/edac/edac_device_sysfs.c
> @@ -253,11 +253,13 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
>  
>  	/* register */
>  	dev_root = bus_get_dev_root(edac_subsys);
> -	if (dev_root) {
> -		err = kobject_init_and_add(&edac_dev->kobj, &ktype_device_ctrl,
> -					   &dev_root->kobj, "%s", edac_dev->name);

What cb4a0bec0bb9 did looks wrong. That if (err) check should be inside
the if (dev_root).

IOW, that function's error checking needs balancing. Something like
this below.

And looking at the other one, it has the same issue...

---
diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
index 237a542e045a..3476ef13e681 100644
--- a/drivers/edac/edac_device_sysfs.c
+++ b/drivers/edac/edac_device_sysfs.c
@@ -228,8 +228,8 @@ static struct kobj_type ktype_device_ctrl = {
  */
 int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
 {
-	struct device *dev_root;
 	const struct bus_type *edac_subsys;
+	struct device *dev_root;
 	int err = -ENODEV;
 
 	edac_dbg(1, "\n");
@@ -243,26 +243,26 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
 	/* Init the devices's kobject */
 	memset(&edac_dev->kobj, 0, sizeof(struct kobject));
 
-	/* Record which module 'owns' this control structure
-	 * and bump the ref count of the module
+	/*
+	 * Record which module 'owns' this control structure and bump
+	 * the ref count of the module
 	 */
 	edac_dev->owner = THIS_MODULE;
 
 	if (!try_module_get(edac_dev->owner))
 		goto err_out;
 
-	/* register */
 	dev_root = bus_get_dev_root(edac_subsys);
-	if (dev_root) {
-		err = kobject_init_and_add(&edac_dev->kobj, &ktype_device_ctrl,
-					   &dev_root->kobj, "%s", edac_dev->name);
-		put_device(dev_root);
-	}
+	if (!dev_root)
+		goto err_module;
+
+	err = kobject_init_and_add(&edac_dev->kobj, &ktype_device_ctrl,
+				   &dev_root->kobj, "%s", edac_dev->name);
 	if (err) {
-		edac_dbg(1, "Failed to register '.../edac/%s'\n",
-			 edac_dev->name);
+		edac_dbg(1, "Failed to register '.../edac/%s'\n", edac_dev->name);
 		goto err_kobj_reg;
 	}
+
 	kobject_uevent(&edac_dev->kobj, KOBJ_ADD);
 
 	/* At this point, to 'free' the control struct,
@@ -273,9 +273,11 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
 
 	return 0;
 
-	/* Error exit stack */
 err_kobj_reg:
 	kobject_put(&edac_dev->kobj);
+	put_device(dev_root);
+
+err_module:
 	module_put(edac_dev->owner);
 
 err_out:

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette