-----原始邮件-----
发件人: "Dave Jiang" [off-list ref]
发送时间: 2021-03-31 00:05:15 (星期三)
收件人: "Lv Yunlong" [off-list ref], vkoul@kernel.org
抄送: dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org
主题: Re: [PATCH] dma: Fix a double free in dma_async_device_register


On 3/30/2021 2:01 AM, Lv Yunlong wrote:

quoted

In the first list_for_each_entry() macro of dma_async_device_register,
it gets the chan from list and calls __dma_async_device_channel_register
(..,chan). We can see that chan->local is allocated by alloc_percpu() and
it is freed chan->local by free_percpu(chan->local) when
__dma_async_device_channel_register() failed.

But after __dma_async_device_channel_register() failed, the caller will
goto err_out and freed the chan->local in the second time by free_percpu().

The cause of this problem is forget to set chan->local to NULL when
chan->local was freed in __dma_async_device_channel_register(). My
patch sets chan->local to NULL when the callee failed to avoid double free.

Thanks for the fix. I think it would make sense to set it to NULL in 
__dma_async_device_channel_register() cleanup path after it calls 
free_percpu(chan->local) right? That would address any other instances 
of this issue happening else where.

quoted

Fixes: d2fb0a0438384 ("dmaengine: break out channel registration")
Signed-off-by: Lv Yunlong <redacted>
---
  drivers/dma/dmaengine.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index fe6a460c4373..fef64b198c95 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c

@@ -1249,8 +1249,10 @@ int dma_async_device_register(struct dma_device *device)
  	/* represent channels in sysfs. Probably want devs too */
  	list_for_each_entry(chan, &device->channels, device_node) {
  		rc = __dma_async_device_channel_register(device, chan);
-		if (rc < 0)
+		if (rc < 0) {
+			chan->local = NULL;
  			goto err_out;
+		}
  	}
  
  	mutex_lock(&dma_list_mutex);

Ok, that is a good idea. I have submitted the PATCH v2.

Thanks.