netdev - Re: gigaset: freeing an active object

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <566550E7.80801@imap.cc>
Date:	Mon, 7 Dec 2015 10:27:03 +0100
From:	Tilman Schmidt <tilman@...p.cc>
To:	Paul Bolle <pebolle@...cali.nl>,
	Peter Hurley <peter@...leysoftware.com>,
	Sasha Levin <sasha.levin@...cle.com>
Cc:	isdn@...ux-pingi.de, davem@...emloft.net,
	gigaset307x-common@...ts.sourceforge.net,
	LKML <linux-kernel@...r.kernel.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	syzkaller <syzkaller@...glegroups.com>
Subject: Re: gigaset: freeing an active object

Am 06.12.2015 um 21:12 schrieb Paul Bolle:
> On zo, 2015-12-06 at 16:29 +0100, Tilman Schmidt wrote:
>> So the solution might be as simple as moving the kfree() call from
>> gigaset_freecshw() to gigaset_device_release(). Something like this:
>>
>> --- a/drivers/isdn/gigaset/ser-gigaset.c
>> +++ b/drivers/isdn/gigaset/ser-gigaset.c
>> @@ -370,19 +370,18 @@ static void gigaset_freecshw(struct cardstate
>> *cs)
>>         tasklet_kill(&cs->write_tasklet);
>>         if (!cs->hw.ser)
>>                 return;
>> -       dev_set_drvdata(&cs->hw.ser->dev.dev, NULL);
>>         platform_device_unregister(&cs->hw.ser->dev);
>> -       kfree(cs->hw.ser);
>> -       cs->hw.ser = NULL;
>>  }
>>
>>  static void gigaset_device_release(struct device *dev)
>>  {
>> -       struct platform_device *pdev = to_platform_device(dev);
>> +       struct cardstate *cs = dev_get_drvdata(dev);
>>
>> -       /* adapted from platform_device_release() in drivers/base/platform.c */
>> -       kfree(dev->platform_data);
>> -       kfree(pdev->resource);
>> +       if (!cs)
>> +               return;
>> +       dev_set_drvdata(dev, NULL);
>> +       kfree(cs->hw.ser);
>> +       cs->hw.ser = NULL;
>>  }
> 
> This solution assumes that the struct platform_device is moved out of
> the struct ser_cardstate, doesn't it? In other words, this is something
> to do on top of my (draft) patch.

No, that wasn't my intention. I thought of that solution as an
alternative, not an increment to your patch.

> Otherwise we'd still be freeing memory
> managed through reference counting.

Now I#m confused. I thought by following Peter's suggestion to put the
kfree() in the release method we'd avoid just that.

Regards,
Tilman

-- 
Tilman Schmidt                              E-Mail: tilman@...p.cc
Bonn, Germany
Nous, on a des fleurs et des bougies pour nous protéger.


Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)