Thread (8 messages) 8 messages, 2 authors, 2016-03-10

Re: [RESEND PATCH 2/2] device property: fix for a case of use-after-free

From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Date: 2016-03-10 09:17:41

On Thu, Mar 10, 2016 at 10:44:45AM +0200, Heikki Krogerus wrote:
On Wed, Mar 09, 2016 at 04:41:12PM +0200, Heikki Krogerus wrote:
quoted
Hi Rafael,
quoted
quoted
diff --git a/drivers/base/property.c b/drivers/base/property.c
index a163f2c..a9df21a9 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -820,11 +820,13 @@ void device_remove_property_set(struct device *dev)
 	 * the pset. If there is no real firmware node (ACPI/DT) primary
 	 * will hold the pset.
 	 */
-	if (!is_pset_node(fwnode))
+	if (is_pset_node(fwnode))
+		dev->fwnode = NULL;
I don't really like the way you clear dev->fwnode directly here.
set_primary_fwnode(dev, NULL) would be more appropriate IMO.

Also set_secondary_fwnode(dev, NULL) need not be done in that case, because it
doesn't change anything.

Moreover, if the primary node is not pset, the secondary one should only be
cleared if it is pset.

So that would mean

	if (is_pset_node(fwnode)) {
		set_primary_fwnode(dev, NULL);
So this does create an other problem. We may now end up having ERR_PTR
in the primary fwnode which of course is not considered in the
property handling code, and would need to be fixed similarly as I
fixed the secondary fwnode checking in 1/2 of this series.

But instead of doing that, the whole logic of handing the
primary/secondary fwnodes is probable a little bit broken and should
really be replaced with something better. We can fix these issues one
by one with the code we have now, but it really looks like one fix
will always result into two new problems. Andy promised to look at it.

In the meantime, would it make sense to go ahead with my proposal to
fix the original problem? As a temporary hack?
Scratch that last question. I'll just prepare a patch with your
proposal and in the same patch change the checking of the primary
fwnode into !IS_ERR_OR_NULL(fwnode). I think it should work for now.


Thanks,

-- 
heikki
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help