lkml.org 
[lkml]   [2021]   [May]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] net: mdio: Fix a double free issue in the .remove function
From
Date
Le 12/05/2021 à 23:44, Russell King - ARM Linux admin a écrit :
> On Wed, May 12, 2021 at 11:35:38PM +0200, Christophe JAILLET wrote:
>> 'bus->mii_bus' have been allocated with 'devm_mdiobus_alloc_size()' in the
>> probe function. So it must not be freed explicitly or there will be a
>> double free.
>>
>> Remove the incorrect 'mdiobus_free' in the remove function.
>
> Yes, this looks correct, thanks.
>
> Reviewed-by: Russell King <rmk+kernel@armlinux.org.uk>
>
> However, there's another issue in this driver that ought to be fixed.
>
> If devm_mdiobus_alloc_size() succeeds, but of_mdiobus_register() fails,
> we continue on to the next bus (which I think is reasonable.) We don't
> free the bus.
>
> When we come to the remove method however, we will call
> mdiobus_unregister() on this existent but not-registered bus. Surely we
> don't want to do that?
>

Hmmm, I don't agree here.

'nexus' is 'kzalloc()'ed.
So the pointers in 'buses[]' are all NULL by default.
We set 'nexus->buses[i] = bus' only when all functions that can fail in
the loop have been called. (the very last 'break' is when the array is full)

And in the remove function, we have:
struct cavium_mdiobus *bus = nexus->buses[i];
if (!bus)
continue;

So, this looks safe to me.

CJ

\
 
 \ /
  Last update: 2021-05-13 08:29    [W:0.074 / U:1.364 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site