linux-kernel - Re: [PATCH] irqchip/renesas-rzg2l: Fix missing put

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <86frph6jir.wl-maz@kernel.org>
Date: Mon, 30 Sep 2024 20:14:52 +0100
From: Marc Zyngier <maz@...nel.org>
To: Fabrizio Castro <fabrizio.castro.jz@...esas.com>
Cc: Thomas Gleixner <tglx@...utronix.de>,
	Geert Uytterhoeven
	<geert+renesas@...der.be>,
	Prabhakar Mahadev Lad
	<prabhakar.mahadev-lad.rj@...renesas.com>,
	"linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
	Chris Paterson <Chris.Paterson2@...esas.com>,
	Biju Das <biju.das.jz@...renesas.com>,
	"linux-renesas-soc@...r.kernel.org"
	<linux-renesas-soc@...r.kernel.org>
Subject: Re: [PATCH] irqchip/renesas-rzg2l: Fix missing put_device

On Mon, 30 Sep 2024 17:36:20 +0100,
Fabrizio Castro <fabrizio.castro.jz@...esas.com> wrote:
> 
> Hi Marc,
> 
> Thanks for your feedback.
> 
> > From: Marc Zyngier <maz@...nel.org>
> > Sent: Monday, September 30, 2024 4:50 PM
> > To: Fabrizio Castro <fabrizio.castro.jz@...esas.com>
> > Subject: Re: [PATCH] irqchip/renesas-rzg2l: Fix missing put_device
> > 
> > On Mon, 30 Sep 2024 15:55:39 +0100,
> > Fabrizio Castro <fabrizio.castro.jz@...esas.com> wrote:
> > >
> > > rzg2l_irqc_common_init calls of_find_device_by_node, but the
> > > corresponding put_device call is missing.
> > >
> > > Make sure we call put_device both when failing and when succeeding.
> > 
> > What sort of lifetime are you trying to enforce?
> 
> Function rzg2l_irqc_common_init uses pdev->dev until its very end.
> My understanding is that we should decrement the reference counter
> once we are fully done with it. Is my understanding correct?

"done with it" is what scares me. Specially when I see code like this:

	rzg2l_irqc_data = devm_kzalloc(&pdev->dev, sizeof(*rzg2l_irqc_data), GFP_KERNEL);
	if (!rzg2l_irqc_data)
		return -ENOMEM;

	rzg2l_irqc_data->irqchip = irq_chip;

	rzg2l_irqc_data->base = devm_of_iomap(&pdev->dev, pdev->dev.of_node, 0, NULL);
	if (IS_ERR(rzg2l_irqc_data->base))
		return PTR_ERR(rzg2l_irqc_data->base);

If you drop the reference on the device, you are allowing it to be
removed, and everything the driver cares about to disappear behind its
back.

I can't really see how this is safe, because in general, removing an
interrupt controller driver from the system is a pretty bad idea, and
I'm worried that's you are implicitly enabling.

	M.

-- 
Without deviation from the norm, progress is not possible.