lkml.org 
[lkml]   [2024]   [Apr]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 1/2] cxl/region: Fix potential invalid pointer dereference
    On Mon, Apr 29, 2024 at 09:31:53AM +0800, Li Zhijian wrote:
    > construct_region() could return a PTR_ERR() which cannot be derefernced.
    > Moving the dereference behind the error checking to make sure the
    > pointer is valid.
    >

    No, this patch is unnecessary.

    drivers/cxl/core/region.c
    3080 /*
    3081 * Ensure that if multiple threads race to construct_region() for @hpa
    3082 * one does the construction and the others add to that.
    3083 */
    3084 mutex_lock(&cxlrd->range_lock);
    3085 region_dev = device_find_child(&cxlrd->cxlsd.cxld.dev, hpa,
    3086 match_region_by_range);
    3087 if (!region_dev) {
    3088 cxlr = construct_region(cxlrd, cxled);
    3089 region_dev = &cxlr->dev;
    ^^^^^^^^^^^
    This is not a dereference, it's just pointer math. In in this case it's
    the same as saying:

    region_dev = (void *)cxlr;

    3090 } else
    3091 cxlr = to_cxl_region(region_dev);
    3092 mutex_unlock(&cxlrd->range_lock);
    3093
    3094 rc = PTR_ERR_OR_ZERO(cxlr);
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^
    This check means that if cxlr is an error pointer then we will clean up
    and return an error.

    regards,
    dan carpenter

    3095 if (rc)
    3096 goto out;
    3097
    3098 attach_target(cxlr, cxled, -1, TASK_UNINTERRUPTIBLE);
    3099
    3100 down_read(&cxl_region_rwsem);
    3101 p = &cxlr->params;
    3102 attach = p->state == CXL_CONFIG_COMMIT;
    3103 up_read(&cxl_region_rwsem);
    3104
    3105 if (attach) {
    3106 /*
    3107 * If device_attach() fails the range may still be active via
    3108 * the platform-firmware memory map, otherwise the driver for
    3109 * regions is local to this file, so driver matching can't fail.
    3110 */
    3111 if (device_attach(&cxlr->dev) < 0)
    3112 dev_err(&cxlr->dev, "failed to enable, range: %pr\n",
    3113 p->res);
    3114 }
    3115
    3116 put_device(region_dev);
    3117 out:
    3118 put_device(cxlrd_dev);
    3119 return rc;
    3120 }



    \
     
     \ /
      Last update: 2024-04-29 12:11    [W:3.695 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site