lkml.org 
[lkml]   [2023]   [Jun]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patches in this message
/
Date
From
SubjectRe: [PATCH] misc: fastrpc: Fix double free of 'buf' in error path
On Fri, May 19, 2023 at 03:57:59PM -0700, Sukrut Bellary wrote:
> On Fri, May 19, 2023 at 11:39:59AM +0100, Srinivas Kandagatla wrote:
> >
> >
> > On 19/05/2023 11:22, Dan Carpenter wrote:
> > > > ----------------------->cut<---------------------------
> > > > diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> > > > index f60bbf99485c..3fdd326e1ae8 100644
> > > > --- a/drivers/misc/fastrpc.c
> > > > +++ b/drivers/misc/fastrpc.c
> > > > @@ -1891,7 +1891,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
> > > > char __user *argp)
> > > > &args[0]);
> > > > if (err) {
> > > > dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size);
> > > > - goto err_invoke;
> > > > + fastrpc_buf_free(buf);
> > > > + return err;
> > > > }
> > > >
> > > > /* update the buffer to be able to deallocate the memory on the DSP
> > > > */
> > > > @@ -1930,11 +1931,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
> > > > char __user *argp)
> > > > return 0;
> > > >
> > > > err_assign:
> > > > - fastrpc_req_munmap_impl(fl, buf);
> > > > -err_invoke:
> > > > - fastrpc_buf_free(buf);
> > > > -
> > > > - return err;
> > > > + return fastrpc_req_munmap_impl(fl, buf);
> > >
> > > This will return success if copy_to_user() fails.
> > >
> > that is true, using return value of fastrpc_req_munmap_impl does not really
> > make sense here we should just return err in either case to the user.
> >
>

I have one follow-up question before I send the v2 patch.
With the following approach, I do see one issue.

----------------------->cut<---------------------------
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index f60bbf99485c..3fdd326e1ae8 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1891,7 +1891,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)
&args[0]);
if (err) {
dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size);
- goto err_invoke;
+ fastrpc_buf_free(buf);
+ return err;
}

/* update the buffer to be able to deallocate the memory on the DSP */
@@ -1930,11 +1931,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)
return 0;

err_assign:
- fastrpc_req_munmap_impl(fl, buf);
-err_invoke:
- fastrpc_buf_free(buf);
-
- return err;
+ fastrpc_req_munmap_impl(fl, buf);
+ return err;
}
----------------------->cut<---------------------------

In this, if qcom_scm_assign_mem() fails, the buf is not added to the list.
But the call to fastrpc_req_munmap_impl() tries to delete the buf
from the list.
To avoid this, we can use the following approach.
Here we first add the buf to the list and fastrpc_req_munmap_impl() would
take care of deleting it in the failure path
Please let me know your review comments.

----------------------->cut<---------------------------
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index f48466960f1b..56751609f412 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1882,7 +1882,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)
&args[0]);
if (err) {
dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size);
- goto err_invoke;
+ fastrpc_buf_free(buf);
+ return err;
}

/* update the buffer to be able to deallocate the memory on the DSP */
@@ -1890,6 +1891,9 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)

/* let the client know the address to use */
req.vaddrout = rsp_msg.vaddr;
+ spin_lock(&fl->lock);
+ list_add_tail(&buf->node, &fl->mmaps);
+ spin_unlock(&fl->lock);

/* Add memory to static PD pool, protection thru hypervisor */
if (req.flags != ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) {
@@ -1906,9 +1910,6 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)
}
}

- spin_lock(&fl->lock);
- list_add_tail(&buf->node, &fl->mmaps);
- spin_unlock(&fl->lock);

if (copy_to_user((void __user *)argp, &req, sizeof(req))) {
err = -EFAULT;
@@ -1922,10 +1923,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)

err_assign:
fastrpc_req_munmap_impl(fl, buf);
-err_invoke:
- fastrpc_buf_free(buf);
-
return err;
+
}
----------------------->cut<---------------------------

Regards,
Sukrut Bellary
> Thanks, Srini and Dan, for reviewing the patch and suggestions.
> I will add this in v2.
>
> Regards,
> Sukrut Bellary
>
> > --srini
> >
> > > regards,
> > > dan carpenter
> > >

\
 
 \ /
  Last update: 2023-06-01 06:46    [W:0.163 / U:0.308 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site