2020-06-18 05:36:26

by Randy Dunlap

Subject: [PATCH -next] lib: fix test_hmm.c reference after free

From: Randy Dunlap <[email protected]>

Coccinelle scripts report the following errors:

lib/test_hmm.c:523:20-26: ERROR: reference preceded by free on line 521
lib/test_hmm.c:524:21-27: ERROR: reference preceded by free on line 521
lib/test_hmm.c:523:28-35: ERROR: devmem is NULL but dereferenced.
lib/test_hmm.c:524:29-36: ERROR: devmem is NULL but dereferenced.

Fix these by using the local variable 'res' instead of devmem.

Signed-off-by: Randy Dunlap <[email protected]>
Cc: Jérôme Glisse <[email protected]>
Cc: [email protected]
Cc: Ralph Campbell <[email protected]>
---
lib/test_hmm.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

--- linux-next-20200617.orig/lib/test_hmm.c
+++ linux-next-20200617/lib/test_hmm.c
@@ -520,8 +520,7 @@ static bool dmirror_allocate_chunk(struc
err_free:
kfree(devmem);
err_release:
- release_mem_region(devmem->pagemap.res.start,
- resource_size(&devmem->pagemap.res));
+ release_mem_region(res->start, resource_size(res));
err:
mutex_unlock(&mdevice->devmem_lock);
return false;

2020-06-18 20:42:30

by Ralph Campbell

Subject: Re: [PATCH -next] lib: fix test_hmm.c reference after free

On 6/17/20 10:31 PM, Randy Dunlap wrote:
> From: Randy Dunlap <[email protected]>
>
> Coccinelle scripts report the following errors:
>
> lib/test_hmm.c:523:20-26: ERROR: reference preceded by free on line 521
> lib/test_hmm.c:524:21-27: ERROR: reference preceded by free on line 521
> lib/test_hmm.c:523:28-35: ERROR: devmem is NULL but dereferenced.
> lib/test_hmm.c:524:29-36: ERROR: devmem is NULL but dereferenced.
>
> Fix these by using the local variable 'res' instead of devmem.
>
> Signed-off-by: Randy Dunlap <[email protected]>
> Cc: Jérôme Glisse <[email protected]>
> Cc: [email protected]
> Cc: Ralph Campbell <[email protected]>
> ---
> lib/test_hmm.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> --- linux-next-20200617.orig/lib/test_hmm.c
> +++ linux-next-20200617/lib/test_hmm.c
> @@ -520,8 +520,7 @@ static bool dmirror_allocate_chunk(struc
> err_free:
> kfree(devmem);
> err_release:
> - release_mem_region(devmem->pagemap.res.start,
> - resource_size(&devmem->pagemap.res));
> + release_mem_region(res->start, resource_size(res));
> err:
> mutex_unlock(&mdevice->devmem_lock);
> return false;
>

Thanks for fixing this!
Reviewed-by: Ralph Campbell <[email protected]>