[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ZF5x3OK2+Rm2njd6@corigine.com>
Date: Fri, 12 May 2023 19:05:32 +0200
From: Simon Horman <simon.horman@...igine.com>
To: m.chetan.kumar@...ux.intel.com
Cc: netdev@...r.kernel.org, kuba@...nel.org, davem@...emloft.net,
johannes@...solutions.net, ryazanov.s.a@...il.com,
loic.poulain@...aro.org, linuxwwan@...el.com,
m.chetan.kumar@...el.com, edumazet@...gle.com, pabeni@...hat.com,
Samuel Wein PhD <sam@...wein.com>
Subject: Re: [PATCH net] net: wwan: iosm: fix NULL pointer dereference when
removing device
On Thu, May 11, 2023 at 03:34:44PM +0530, m.chetan.kumar@...ux.intel.com wrote:
> From: M Chetan Kumar <m.chetan.kumar@...ux.intel.com>
>
> In suspend and resume cycle, the removal and rescan of device ends
> up in NULL pointer dereference.
>
> During driver initialization, if the ipc_imem_wwan_channel_init()
> fails to get the valid device capabilities it returns an error and
> further no resource (wwan struct) will be allocated. Now in this
> situation if driver removal procedure is initiated it would result
> in NULL pointer exception since unallocated wwan struct is dereferenced
> inside ipc_wwan_deinit().
>
> ipc_imem_run_state_worker() to handle the called functions return value
> and to release the resource in failure case. It also reports the link
> down event in failure cases. The user space application can handle this
> event to do a device reset for restoring the device communication.
>
> Fixes: 3670970dd8c6 ("net: iosm: shared memory IPC interface")
> Reported-by: Samuel Wein PhD <sam@...wein.com>
> Closes: https://lore.kernel.org/netdev/20230427140819.1310f4bd@kernel.org/T/
> Signed-off-by: M Chetan Kumar <m.chetan.kumar@...ux.intel.com>
...
> @@ -622,6 +630,15 @@ static void ipc_imem_run_state_worker(struct work_struct *instance)
>
> /* Complete all memory stores after setting bit */
> smp_mb__after_atomic();
> +
> + return;
> +
> +err_channel_init:
> + ipc_mux_deinit(ipc_imem->mux);
> +err_mux_init:
> +err_cap_init:
> +err_cp_phase:
> + ipc_uevent_send(ipc_imem->dev, UEVENT_CD_READY_LINK_DOWN);
Hi Chentan,
Thanks for your patch.
a nit from my side.
I think it is preferable for labels to be named after what they do
rather than where they are called from.
Something like:
err_mux_deinit:
ipc_mux_deinit(ipc_imem->mux);
err_out:
ipc_uevent_send(ipc_imem->dev, UEVENT_CD_READY_LINK_DOWN);
I also note that if ipc_mux_deinit() checked for a NULL (and did nothing),
then this could become:
err_out:
ipc_mux_deinit(ipc_imem->mux);
ipc_uevent_send(ipc_imem->dev, UEVENT_CD_READY_LINK_DOWN);
> }
>
...
Powered by blists - more mailing lists