netdev - Re: [PATCH] ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241108133901.GD4507@kernel.org>
Date: Fri, 8 Nov 2024 13:39:01 +0000
From: Simon Horman <horms@...nel.org>
To: Keisuke Nishimura <keisuke.nishimura@...ia.fr>
Cc: Alexander Aring <alex.aring@...il.com>,
	Stefan Schmidt <stefan@...enfreihafen.org>,
	Miquel Raynal <miquel.raynal@...tlin.com>,
	Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	linux-wpan@...r.kernel.org, netdev@...r.kernel.org,
	Marcel Holtmann <marcel@...tmann.org>
Subject: Re: [PATCH] ieee802154: ca8210: Add missing check for kfifo_alloc()
 in ca8210_probe()

On Mon, Nov 04, 2024 at 11:24:42PM +0100, Keisuke Nishimura wrote:
> 
> 
> On 04/11/2024 13:12, Simon Horman wrote:
> > + Marcel
> > 
> > On Tue, Oct 29, 2024 at 07:27:12PM +0100, Keisuke Nishimura wrote:
> >> ca8210_test_interface_init() returns the result of kfifo_alloc(),
> >> which can be non-zero in case of an error. The caller, ca8210_probe(),
> >> should check the return value and do error-handling if it fails.
> >>
> >> Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
> >> Signed-off-by: Keisuke Nishimura <keisuke.nishimura@...ia.fr>
> >> ---
> >>   drivers/net/ieee802154/ca8210.c | 6 +++++-
> >>   1 file changed, 5 insertions(+), 1 deletion(-)
> >>
> >> diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
> >> index e685a7f946f0..753215ebc67c 100644
> >> --- a/drivers/net/ieee802154/ca8210.c
> >> +++ b/drivers/net/ieee802154/ca8210.c
> >> @@ -3072,7 +3072,11 @@ static int ca8210_probe(struct spi_device *spi_device)
> >>   	spi_set_drvdata(priv->spi, priv);
> >>   	if (IS_ENABLED(CONFIG_IEEE802154_CA8210_DEBUGFS)) {
> >>   		cascoda_api_upstream = ca8210_test_int_driver_write;
> >> -		ca8210_test_interface_init(priv);
> >> +		ret = ca8210_test_interface_init(priv);
> >> +		if (ret) {
> >> +			dev_crit(&spi_device->dev, "ca8210_test_interface_init failed\n");
> >> +			goto error;
> > 
> > Hi Nishimura-san,
> > 
> > I see that this will conditionally call kfifo_free().
> > Is that safe here? And in branches to error above this point?
> > 
> 
> Hi Horman-san,
> 
> Thank you for taking a look at this patch.
> 
> > Is that safe here?
> 
> Yes, it is safe. The failure of kfifo_alloc(&test->up_fifo,
> CA8210_TEST_INT_FIFO_SIZE, GFP_KERNEL) sets test->up_fifo.data to NULL,
> and kfifo_free() will then do kfree(test->up_fifo.data) with some minor
> clean-up.

Thanks, sounds good.

> > And in branches to error above this point?
> 
> Are you referring to the error handling for ieee802154_alloc_hw()?

Yes.

> To my
> understanding, since spi_get_drvdata() in ca8210_remove() returns NULL
> if there's an error, we shouldn’t need to call
> ca8210_test_interface_clear(). However, I’m not familiar with this code,
> so please correct me if I'm mistaken.

That makes two of us. But I don't think your patch changes this situation.
And it does improve things wrt to the problem described in your commit
message. So, while I think it would be worth looking into the error
handling for ieee802154_alloc_hw() I don't think it needs to block progress
of this patch.

Reviewed-by: Simon Horman <horms@...nel.org>