2020-09-23 20:46:50

by Vadym Kochan

[permalink] [raw]
Subject: [PATCH v3] nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell()

Fix missing 'kfree_const(cell->name)' when call to
nvmem_cell_info_to_nvmem_cell() in several places:

* after nvmem_cell_info_to_nvmem_cell() failed during
nvmem_add_cells()

* during nvmem_device_cell_{read,write} when cell->name is
kstrdup'ed() without calling kfree_const() at the end, but
really there is no reason to do that 'dup, because the cell
instance is allocated on the stack for some short period to be
read/write without exposing it to the caller.

So the new nvmem_cell_info_to_nvmem_cell_nodup() helper is introduced
which is used to convert cell_info -> cell without name duplication as
a lighweight version of nvmem_cell_info_to_nvmem_cell().

Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")
Signed-off-by: Vadym Kochan <[email protected]>
---
v3:
* rename __nvmem_cell_info_to_nvmem_cell() -> nvmem_cell_info_to_nvmem_cell_nodup()

* rephrase commit description a bit

* get rid of wrong func line wrapping

v2:
* remove not needed 'kfree_const(cell->name)' after nvmem_cell_info_to_nvmem_cell()
failed.

drivers/nvmem/core.c | 33 ++++++++++++++++++++++++---------
1 file changed, 24 insertions(+), 9 deletions(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 6cd3edb2eaf6..10cd935cf30e 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -361,16 +361,14 @@ static void nvmem_cell_add(struct nvmem_cell *cell)
blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_ADD, cell);
}

-static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
- const struct nvmem_cell_info *info,
- struct nvmem_cell *cell)
+static int nvmem_cell_info_to_nvmem_cell_nodup(struct nvmem_device *nvmem,
+ const struct nvmem_cell_info *info,
+ struct nvmem_cell *cell)
{
cell->nvmem = nvmem;
cell->offset = info->offset;
cell->bytes = info->bytes;
- cell->name = kstrdup_const(info->name, GFP_KERNEL);
- if (!cell->name)
- return -ENOMEM;
+ cell->name = info->name;

cell->bit_offset = info->bit_offset;
cell->nbits = info->nbits;
@@ -382,13 +380,30 @@ static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
dev_err(&nvmem->dev,
"cell %s unaligned to nvmem stride %d\n",
- cell->name, nvmem->stride);
+ cell->name ?: "<unknown>", nvmem->stride);
return -EINVAL;
}

return 0;
}

+static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
+ const struct nvmem_cell_info *info,
+ struct nvmem_cell *cell)
+{
+ int err;
+
+ err = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, cell);
+ if (err)
+ return err;
+
+ cell->name = kstrdup_const(info->name, GFP_KERNEL);
+ if (!cell->name)
+ return -ENOMEM;
+
+ return 0;
+}
+
/**
* nvmem_add_cells() - Add cell information to an nvmem device
*
@@ -1460,7 +1475,7 @@ ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem,
if (!nvmem)
return -EINVAL;

- rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
+ rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);
if (rc)
return rc;

@@ -1490,7 +1505,7 @@ int nvmem_device_cell_write(struct nvmem_device *nvmem,
if (!nvmem)
return -EINVAL;

- rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
+ rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);
if (rc)
return rc;

--
2.17.1


2020-09-25 09:36:09

by Srinivas Kandagatla

[permalink] [raw]
Subject: Re: [PATCH v3] nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell()



On 23/09/2020 21:44, Vadym Kochan wrote:
> Fix missing 'kfree_const(cell->name)' when call to
> nvmem_cell_info_to_nvmem_cell() in several places:
>
> * after nvmem_cell_info_to_nvmem_cell() failed during
> nvmem_add_cells()
>
> * during nvmem_device_cell_{read,write} when cell->name is
> kstrdup'ed() without calling kfree_const() at the end, but
> really there is no reason to do that 'dup, because the cell
> instance is allocated on the stack for some short period to be
> read/write without exposing it to the caller.
>
> So the new nvmem_cell_info_to_nvmem_cell_nodup() helper is introduced
> which is used to convert cell_info -> cell without name duplication as
> a lighweight version of nvmem_cell_info_to_nvmem_cell().
>
> Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")
> Signed-off-by: Vadym Kochan <[email protected]>

Looks good to me! Thanks for the patch.

Reviewed-by: Srinivas Kandagatla <[email protected]>
Acked-by: Srinivas Kandagatla <[email protected]>

Greg,

Can you please pick this one? As don't have any nvmem pending patches to
send it together.

thanks,
srini


> ---
> v3:
> * rename __nvmem_cell_info_to_nvmem_cell() -> nvmem_cell_info_to_nvmem_cell_nodup()
>
> * rephrase commit description a bit
>
> * get rid of wrong func line wrapping
>
> v2:
> * remove not needed 'kfree_const(cell->name)' after nvmem_cell_info_to_nvmem_cell()
> failed.
>
> drivers/nvmem/core.c | 33 ++++++++++++++++++++++++---------
> 1 file changed, 24 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
> index 6cd3edb2eaf6..10cd935cf30e 100644
> --- a/drivers/nvmem/core.c
> +++ b/drivers/nvmem/core.c
> @@ -361,16 +361,14 @@ static void nvmem_cell_add(struct nvmem_cell *cell)
> blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_ADD, cell);
> }
>
> -static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> - const struct nvmem_cell_info *info,
> - struct nvmem_cell *cell)
> +static int nvmem_cell_info_to_nvmem_cell_nodup(struct nvmem_device *nvmem,
> + const struct nvmem_cell_info *info,
> + struct nvmem_cell *cell)
> {
> cell->nvmem = nvmem;
> cell->offset = info->offset;
> cell->bytes = info->bytes;
> - cell->name = kstrdup_const(info->name, GFP_KERNEL);
> - if (!cell->name)
> - return -ENOMEM;
> + cell->name = info->name;
>
> cell->bit_offset = info->bit_offset;
> cell->nbits = info->nbits;
> @@ -382,13 +380,30 @@ static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
> dev_err(&nvmem->dev,
> "cell %s unaligned to nvmem stride %d\n",
> - cell->name, nvmem->stride);
> + cell->name ?: "<unknown>", nvmem->stride);
> return -EINVAL;
> }
>
> return 0;
> }
>
> +static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> + const struct nvmem_cell_info *info,
> + struct nvmem_cell *cell)
> +{
> + int err;
> +
> + err = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, cell);
> + if (err)
> + return err;
> +
> + cell->name = kstrdup_const(info->name, GFP_KERNEL);
> + if (!cell->name)
> + return -ENOMEM;
> +
> + return 0;
> +}
> +
> /**
> * nvmem_add_cells() - Add cell information to an nvmem device
> *
> @@ -1460,7 +1475,7 @@ ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem,
> if (!nvmem)
> return -EINVAL;
>
> - rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> + rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);
> if (rc)
> return rc;
>
> @@ -1490,7 +1505,7 @@ int nvmem_device_cell_write(struct nvmem_device *nvmem,
> if (!nvmem)
> return -EINVAL;
>
> - rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> + rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);
> if (rc)
> return rc;
>
>

2020-09-27 12:28:49

by Greg Kroah-Hartman

[permalink] [raw]
Subject: Re: [PATCH v3] nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell()

On Fri, Sep 25, 2020 at 10:32:42AM +0100, Srinivas Kandagatla wrote:
>
>
> On 23/09/2020 21:44, Vadym Kochan wrote:
> > Fix missing 'kfree_const(cell->name)' when call to
> > nvmem_cell_info_to_nvmem_cell() in several places:
> >
> > * after nvmem_cell_info_to_nvmem_cell() failed during
> > nvmem_add_cells()
> >
> > * during nvmem_device_cell_{read,write} when cell->name is
> > kstrdup'ed() without calling kfree_const() at the end, but
> > really there is no reason to do that 'dup, because the cell
> > instance is allocated on the stack for some short period to be
> > read/write without exposing it to the caller.
> >
> > So the new nvmem_cell_info_to_nvmem_cell_nodup() helper is introduced
> > which is used to convert cell_info -> cell without name duplication as
> > a lighweight version of nvmem_cell_info_to_nvmem_cell().
> >
> > Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")
> > Signed-off-by: Vadym Kochan <[email protected]>
>
> Looks good to me! Thanks for the patch.
>
> Reviewed-by: Srinivas Kandagatla <[email protected]>
> Acked-by: Srinivas Kandagatla <[email protected]>
>
> Greg,
>
> Can you please pick this one? As don't have any nvmem pending patches to
> send it together.

Will do, thanks.

greg k-h