Re: [PATCH v2] nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell()
From: Srinivas Kandagatla
Date: Wed Sep 23 2020 - 10:47:23 EST
On 23/09/2020 15:13, Vadym Kochan wrote:
On Wed, Sep 23, 2020 at 03:10:36PM +0100, Srinivas Kandagatla wrote:
On 23/09/2020 14:53, Vadym Kochan wrote:
Fix missing 'kfree_const(cell->name)' when call to
nvmem_cell_info_to_nvmem_cell() in several places:
* after nvmem_cell_info_to_nvmem_cell() failed during
nvmem_add_cells()
* during nvmem_device_cell_{read,write}. This is fixed by simply
re-using info->name instead of duplicating it:
cell->name = info->name
Because cell->name is not used except for error message printing in case
of un-aligned access, the new __nvmem_cell_info_to_nvmem_cell() helper
was introduced.
Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")
Signed-off-by: Vadym Kochan <vadym.kochan@xxxxxxxxxxx>
---
v2:
* remove not needed 'kfree_const(cell->name)' after nvmem_cell_info_to_nvmem_cell()
failed.
drivers/nvmem/core.c | 35 ++++++++++++++++++++++++++---------
1 file changed, 26 insertions(+), 9 deletions(-)
Really :-)
But what about nvmem_device_cell_{read,write} case ?
In my understanding the cell is allocated on the stack but kstrdup() is
You are right!
That is the second issue where the caller outside would fail after
successful call to nvmem_cell_info_to_nvmem_cell() .
Probably we cam free it in failure cases!
something like:
------------------------>cut<---------------------------
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 6cd3edb2eaf6..fb1e756adcee 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -383,6 +383,7 @@ static int nvmem_cell_info_to_nvmem_cell(struct
nvmem_device *nvmem,
dev_err(&nvmem->dev,
"cell %s unaligned to nvmem stride %d\n",
cell->name, nvmem->stride);
+ kfree_const(cell->name);
return -EINVAL;
}
@@ -1465,8 +1466,10 @@ ssize_t nvmem_device_cell_read(struct
nvmem_device *nvmem,
return rc;
rc = __nvmem_cell_read(nvmem, &cell, buf, &len);
- if (rc)
+ if (rc) {
+ kfree_const(cell->name);
return rc;
+ }
return len;
}
@@ -1494,7 +1497,11 @@ int nvmem_device_cell_write(struct nvmem_device
*nvmem,
if (rc)
return rc;
- return nvmem_cell_write(&cell, buf, cell.bytes);
+ rc = nvmem_cell_write(&cell, buf, cell.bytes);
+ if (rc)
+ kfree_const(cell->name);
+
+ return rc;
}
EXPORT_SYMBOL_GPL(nvmem_device_cell_write);
------------------------>cut<---------------------------
--srini
not freed in the end, or I missed something ?
Below change should just fix this the reported issue!
------------------------>cut<---------------------------
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 6cd3edb2eaf6..9fb9112fe75d 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -383,6 +383,7 @@ static int nvmem_cell_info_to_nvmem_cell(struct
nvmem_device *nvmem,
dev_err(&nvmem->dev,
"cell %s unaligned to nvmem stride %d\n",
cell->name, nvmem->stride);
+ kfree_const(cell->name);
return -EINVAL;
}
------------------------>cut<---------------------------
I don't see a point in the way your patch try to fix this!!
--srini
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 6cd3edb2eaf6..e6d1bc414faf 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -361,16 +361,15 @@ static void nvmem_cell_add(struct nvmem_cell *cell)
blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_ADD, cell);
}
-static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
- const struct nvmem_cell_info *info,
- struct nvmem_cell *cell)
+static int
+__nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
+ const struct nvmem_cell_info *info,
+ struct nvmem_cell *cell)
{
cell->nvmem = nvmem;
cell->offset = info->offset;
cell->bytes = info->bytes;
- cell->name = kstrdup_const(info->name, GFP_KERNEL);
- if (!cell->name)
- return -ENOMEM;
+ cell->name = info->name;
cell->bit_offset = info->bit_offset;
cell->nbits = info->nbits;
@@ -382,13 +381,31 @@ static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
dev_err(&nvmem->dev,
"cell %s unaligned to nvmem stride %d\n",
- cell->name, nvmem->stride);
+ cell->name ?: "<unknown>", nvmem->stride);
return -EINVAL;
}
return 0;
}
+static int
+nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
+ const struct nvmem_cell_info *info,
+ struct nvmem_cell *cell)
+{
+ int err;
+
+ err = __nvmem_cell_info_to_nvmem_cell(nvmem, info, cell);
+ if (err)
+ return err;
+
+ cell->name = kstrdup_const(info->name, GFP_KERNEL);
+ if (!cell->name)
+ return -ENOMEM;
+
+ return 0;
+}
+
/**
* nvmem_add_cells() - Add cell information to an nvmem device
*
@@ -1460,7 +1477,7 @@ ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem,
if (!nvmem)
return -EINVAL;
- rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
+ rc = __nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
if (rc)
return rc;
@@ -1490,7 +1507,7 @@ int nvmem_device_cell_write(struct nvmem_device *nvmem,
if (!nvmem)
return -EINVAL;
- rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
+ rc = __nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
if (rc)
return rc;