2018-11-05 08:30:04

by He, Bo

[permalink] [raw]
Subject: [PATCH] fix the kernel panic due to wrong use the dev memory API

skl->dais is allocated with devm_kcalloc, can't free with
the krealloc. Memory allocated with devm API is automatically freed
on driver detach, Like all other devres resources.

Refer to drivers/base/devres.c devm_kmalloc for more details.

Signed-off-by: he, bo <[email protected]>
---
sound/soc/intel/skylake/skl-pcm.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index 823e391..928d314 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -1438,7 +1438,8 @@ int skl_platform_register(struct device *dev)
}

if (!skl->use_tplg_pcm) {
- dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
+ devm_kfree(dev, skl->dais);
+ dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
sizeof(skl_platform_dai), GFP_KERNEL);
if (!dais) {
ret = -ENOMEM;
@@ -1472,7 +1473,5 @@ int skl_platform_unregister(struct device *dev)
}
}

- kfree(skl->dais);
-
return 0;
}
--
2.7.4





2018-11-05 10:40:35

by kernel test robot

[permalink] [raw]
Subject: Re: [PATCH] fix the kernel panic due to wrong use the dev memory API

Hi Bo,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on asoc/for-next]
[also build test WARNING on v4.20-rc1 next-20181105]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url: https://github.com/0day-ci/linux/commits/He-Bo/fix-the-kernel-panic-due-to-wrong-use-the-dev-memory-API/20181105-175620
base: https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next
config: i386-randconfig-x014-201844 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
# save the attached .config to linux build tree
make ARCH=i386

All warnings (new ones prefixed by >>):

sound/soc/intel/skylake/skl-pcm.c: In function 'skl_platform_register':
>> sound/soc/intel/skylake/skl-pcm.c:1489:28: warning: passing argument 2 of 'devm_kcalloc' makes integer from pointer without a cast [-Wint-conversion]
dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
^~~
In file included from include/linux/pci.h:31:0,
from sound/soc/intel/skylake/skl-pcm.c:22:
include/linux/device.h:690:21: note: expected 'size_t {aka unsigned int}' but argument is of type 'struct snd_soc_dai_driver *'
static inline void *devm_kcalloc(struct device *dev,
^~~~~~~~~~~~

vim +/devm_kcalloc +1489 sound/soc/intel/skylake/skl-pcm.c

1468
1469 int skl_platform_register(struct device *dev)
1470 {
1471 int ret;
1472 struct snd_soc_dai_driver *dais;
1473 int num_dais = ARRAY_SIZE(skl_platform_dai);
1474 struct hdac_bus *bus = dev_get_drvdata(dev);
1475 struct skl *skl = bus_to_skl(bus);
1476
1477 INIT_LIST_HEAD(&skl->ppl_list);
1478 INIT_LIST_HEAD(&skl->bind_list);
1479
1480 skl->dais = kmemdup(skl_platform_dai, sizeof(skl_platform_dai),
1481 GFP_KERNEL);
1482 if (!skl->dais) {
1483 ret = -ENOMEM;
1484 goto err;
1485 }
1486
1487 if (!skl->use_tplg_pcm) {
1488 devm_kfree(dev, skl->dais);
> 1489 dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
1490 sizeof(skl_platform_dai), GFP_KERNEL);
1491 if (!dais) {
1492 ret = -ENOMEM;
1493 goto err;
1494 }
1495
1496 skl->dais = dais;
1497 memcpy(&skl->dais[ARRAY_SIZE(skl_platform_dai)], skl_fe_dai,
1498 sizeof(skl_fe_dai));
1499 num_dais += ARRAY_SIZE(skl_fe_dai);
1500 }
1501
1502 ret = devm_snd_soc_register_component(dev, &skl_component,
1503 skl->dais, num_dais);
1504 if (ret)
1505 dev_err(dev, "soc component registration failed %d\n", ret);
1506 err:
1507 return ret;
1508 }
1509

---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation


Attachments:
(No filename) (2.86 kB)
.config.gz (27.09 kB)
Download all attachments

2018-11-05 17:02:32

by Pierre-Louis Bossart

[permalink] [raw]
Subject: Re: [alsa-devel] [PATCH] fix the kernel panic due to wrong use the dev memory API


On 11/5/18 2:29 AM, He, Bo wrote:
> skl->dais is allocated with devm_kcalloc, can't free with
> the krealloc. Memory allocated with devm API is automatically freed
> on driver detach, Like all other devres resources.
>
> Refer to drivers/base/devres.c devm_kmalloc for more details.

What code are you looking at?

I see this in the Mark's tree

int skl_platform_register(struct device *dev)
{
    int ret;
    struct snd_soc_dai_driver *dais;
    int num_dais = ARRAY_SIZE(skl_platform_dai);
    struct hdac_bus *bus = dev_get_drvdata(dev);
    struct skl *skl = bus_to_skl(bus);

    INIT_LIST_HEAD(&skl->ppl_list);
    INIT_LIST_HEAD(&skl->bind_list);

    skl->dais = kmemdup(skl_platform_dai, sizeof(skl_platform_dai),
                GFP_KERNEL);
    if (!skl->dais) {
        ret = -ENOMEM;
        goto err;
    }

    if (!skl->use_tplg_pcm) {
        dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
                sizeof(skl_platform_dai), GFP_KERNEL);


No trace of devm as you mention it? I checked the Chrome tree as well
and it's not there.

What am I missing?


>
> Signed-off-by: he, bo <[email protected]>
> ---
> sound/soc/intel/skylake/skl-pcm.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
> index 823e391..928d314 100644
> --- a/sound/soc/intel/skylake/skl-pcm.c
> +++ b/sound/soc/intel/skylake/skl-pcm.c
> @@ -1438,7 +1438,8 @@ int skl_platform_register(struct device *dev)
> }
>
> if (!skl->use_tplg_pcm) {
> - dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
> + devm_kfree(dev, skl->dais);
> + dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
> sizeof(skl_platform_dai), GFP_KERNEL);
> if (!dais) {
> ret = -ENOMEM;
> @@ -1472,7 +1473,5 @@ int skl_platform_unregister(struct device *dev)
> }
> }
>
> - kfree(skl->dais);
> -
> return 0;
> }

2018-11-06 00:59:27

by He, Bo

[permalink] [raw]
Subject: RE: [alsa-devel] [PATCH] fix the kernel panic due to wrong use the dev memory API

Hi,
I submit the patch based on tag v4.19.

-----Original Message-----
From: Pierre-Louis Bossart <[email protected]>
Sent: Tuesday, November 6, 2018 1:02 AM
To: He, Bo <[email protected]>; [email protected]; [email protected]
Cc: [email protected]; [email protected]; [email protected]; Singh, Guneshwor O <[email protected]>; Periyasamy, SriramX <[email protected]>; Kale, Sanyog R <[email protected]>; Kesapragada, Pardha Saradhi <[email protected]>; [email protected]; [email protected]; Ughreja, Rakesh A <[email protected]>; Prakash, Divya1 <[email protected]>; Diwakar, Praveen <[email protected]>; Zhang, Yanmin <[email protected]>
Subject: Re: [alsa-devel] [PATCH] fix the kernel panic due to wrong use the dev memory API


On 11/5/18 2:29 AM, He, Bo wrote:
> skl->dais is allocated with devm_kcalloc, can't free with
> the krealloc. Memory allocated with devm API is automatically freed on
> driver detach, Like all other devres resources.
>
> Refer to drivers/base/devres.c devm_kmalloc for more details.

What code are you looking at?

I see this in the Mark's tree

int skl_platform_register(struct device *dev) {
    int ret;
    struct snd_soc_dai_driver *dais;
    int num_dais = ARRAY_SIZE(skl_platform_dai);
    struct hdac_bus *bus = dev_get_drvdata(dev);
    struct skl *skl = bus_to_skl(bus);

    INIT_LIST_HEAD(&skl->ppl_list);
    INIT_LIST_HEAD(&skl->bind_list);

    skl->dais = kmemdup(skl_platform_dai, sizeof(skl_platform_dai),
                GFP_KERNEL);
    if (!skl->dais) {
        ret = -ENOMEM;
        goto err;
    }

    if (!skl->use_tplg_pcm) {
        dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
                sizeof(skl_platform_dai), GFP_KERNEL);


No trace of devm as you mention it? I checked the Chrome tree as well and it's not there.

What am I missing?


>
> Signed-off-by: he, bo <[email protected]>
> ---
> sound/soc/intel/skylake/skl-pcm.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/sound/soc/intel/skylake/skl-pcm.c
> b/sound/soc/intel/skylake/skl-pcm.c
> index 823e391..928d314 100644
> --- a/sound/soc/intel/skylake/skl-pcm.c
> +++ b/sound/soc/intel/skylake/skl-pcm.c
> @@ -1438,7 +1438,8 @@ int skl_platform_register(struct device *dev)
> }
>
> if (!skl->use_tplg_pcm) {
> - dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
> + devm_kfree(dev, skl->dais);
> + dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
> sizeof(skl_platform_dai), GFP_KERNEL);
> if (!dais) {
> ret = -ENOMEM;
> @@ -1472,7 +1473,5 @@ int skl_platform_unregister(struct device *dev)
> }
> }
>
> - kfree(skl->dais);
> -
> return 0;
> }

2018-11-06 14:42:33

by Pierre-Louis Bossart

[permalink] [raw]
Subject: Re: [alsa-devel] [PATCH] fix the kernel panic due to wrong use the dev memory API

On 11/5/18 6:58 PM, He, Bo wrote:
> Hi,
> I submit the patch based on tag v4.19.

Please don't post on mailing lists.

>
> -----Original Message-----
> From: Pierre-Louis Bossart <[email protected]>
> Sent: Tuesday, November 6, 2018 1:02 AM
> To: He, Bo <[email protected]>; [email protected]; [email protected]
> Cc: [email protected]; [email protected]; [email protected]; Singh, Guneshwor O <[email protected]>; Periyasamy, SriramX <[email protected]>; Kale, Sanyog R <[email protected]>; Kesapragada, Pardha Saradhi <[email protected]>; [email protected]; [email protected]; Ughreja, Rakesh A <[email protected]>; Prakash, Divya1 <[email protected]>; Diwakar, Praveen <[email protected]>; Zhang, Yanmin <[email protected]>
> Subject: Re: [alsa-devel] [PATCH] fix the kernel panic due to wrong use the dev memory API
>
>
> On 11/5/18 2:29 AM, He, Bo wrote:
>> skl->dais is allocated with devm_kcalloc, can't free with
>> the krealloc. Memory allocated with devm API is automatically freed on
>> driver detach, Like all other devres resources.
>>
>> Refer to drivers/base/devres.c devm_kmalloc for more details.
>
> What code are you looking at?
>
> I see this in the Mark's tree
>
> int skl_platform_register(struct device *dev) {
>     int ret;
>     struct snd_soc_dai_driver *dais;
>     int num_dais = ARRAY_SIZE(skl_platform_dai);
>     struct hdac_bus *bus = dev_get_drvdata(dev);
>     struct skl *skl = bus_to_skl(bus);
>
>     INIT_LIST_HEAD(&skl->ppl_list);
>     INIT_LIST_HEAD(&skl->bind_list);
>
>     skl->dais = kmemdup(skl_platform_dai, sizeof(skl_platform_dai),
>                 GFP_KERNEL);
>     if (!skl->dais) {
>         ret = -ENOMEM;
>         goto err;
>     }
>
>     if (!skl->use_tplg_pcm) {
>         dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
>                 sizeof(skl_platform_dai), GFP_KERNEL);
>
>
> No trace of devm as you mention it? I checked the Chrome tree as well and it's not there.
>
> What am I missing?

The code is completely identical in v4.19. skl->dais is allocated with
kmemdup, which is a kmalloc+memcpy, i just don't understand what you are
trying to fix.

>
>
>>
>> Signed-off-by: he, bo <[email protected]>
>> ---
>> sound/soc/intel/skylake/skl-pcm.c | 5 ++---
>> 1 file changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/sound/soc/intel/skylake/skl-pcm.c
>> b/sound/soc/intel/skylake/skl-pcm.c
>> index 823e391..928d314 100644
>> --- a/sound/soc/intel/skylake/skl-pcm.c
>> +++ b/sound/soc/intel/skylake/skl-pcm.c
>> @@ -1438,7 +1438,8 @@ int skl_platform_register(struct device *dev)
>> }
>>
>> if (!skl->use_tplg_pcm) {
>> - dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
>> + devm_kfree(dev, skl->dais);
>> + dais = devm_kcalloc(dev, skl->dais, sizeof(skl_fe_dai) +
>> sizeof(skl_platform_dai), GFP_KERNEL);
>> if (!dais) {
>> ret = -ENOMEM;
>> @@ -1472,7 +1473,5 @@ int skl_platform_unregister(struct device *dev)
>> }
>> }
>>
>> - kfree(skl->dais);
>> -
>> return 0;
>> }