Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 10 Feb 2021 09:31:00 -0800
From:   Drew Fustini <drew@beagleboard.org>
To:     Andy Shevchenko <andy.shevchenko@gmail.com>
Cc:     Linus Walleij <linus.walleij@linaro.org>,
        "open list:GPIO SUBSYSTEM" <linux-gpio@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Tony Lindgren <tony@atomide.com>,
        Alexandre Belloni <alexandre.belloni@bootlin.com>,
        Geert Uytterhoeven <geert@linux-m68k.org>,
        Pantelis Antoniou <pantelis.antoniou@konsulko.com>,
        Jason Kridner <jkridner@beagleboard.org>,
        Robert Nelson <robertcnelson@beagleboard.org>
Subject: Re: [PATCH v2 2/2] pinctrl: pinmux: Add pinmux-select debugfs file
Message-ID: <20210210173100.GA178344@x1>
References: <20210210074946.155417-1-drew@beagleboard.org>
 <20210210074946.155417-3-drew@beagleboard.org>
 <CAHp75VcDVVZ=hg5hfRTs9hJ20gdEE_Xhccyg859nsvtyxTXCyw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAHp75VcDVVZ=hg5hfRTs9hJ20gdEE_Xhccyg859nsvtyxTXCyw@mail.gmail.com>
Precedence: bulk

On Wed, Feb 10, 2021 at 11:56:49AM +0200, Andy Shevchenko wrote:
> On Wed, Feb 10, 2021 at 9:50 AM Drew Fustini <drew@beagleboard.org> wrote:
> >
> > Add "pinmux-select" to debugfs which will activate a function and group
> > when 2 integers "<function-selector> <group-selector>" are written to
> > the file. The write operation pinmux_select() handles this by checking
> > if fsel and gsel are valid selectors and then calling ops->set_mux().
> >
> > The existing "pinmux-functions" debugfs file lists the pin functions
> > registered for the pin controller. For example:
> >
> > function: pinmux-uart0, groups = [ pinmux-uart0-pins ]
> > function: pinmux-mmc0, groups = [ pinmux-mmc0-pins ]
> > function: pinmux-mmc1, groups = [ pinmux-mmc1-pins ]
> > function: pinmux-i2c0, groups = [ pinmux-i2c0-pins ]
> > function: pinmux-i2c1, groups = [ pinmux-i2c1-pins ]
> > function: pinmux-spi1, groups = [ pinmux-spi1-pins ]
> >
> > To activate function pinmux-i2c1 (fsel 4) and group pinmux-i2c1-pins
> > (gsel 4):
> >
> > echo '4 4' > pinmux-select
> 
> ...
> 
> >  DEFINE_SHOW_ATTRIBUTE(pinmux_pins);
> >
> 
> > +
> 
> One blank line (existed) is enough.
> 
> > +#define PINMUX_MAX_NAME 64
> 
> ...
> 
> > +       buf = devm_kzalloc(pctldev->dev, PINMUX_MAX_NAME * 2, GFP_KERNEL);
> 
> You have to (re-)read documentation about Device Managed Resources.
> Keyword here is *device*! Pay attention to it. TL;DR: misuse of device
> managed resources here.
> Potentially memory exhausting (local DoS attack), but see below.
> 
> > +       if (!buf)
> > +               return -ENOMEM;
> 
> ...
> 
> > +       devm_kfree(pctldev->dev, buf);
> 
> Calling devm_kfree() or other devm_*() release kinda APIs is a red
> flag in 99%. See above.

Thank you for reviewing and pointing out this issue.

Do you mean that I should not be treating these buffers used in the 
debugfs write op as belonging to the pin controller device?

I have looked through the kernel code and I realize now that I don't see
any instances of devm_*() being used inside the read or write op for a
debugfs file. As I consider it further, devm_*() does not seem to make
sense as I am creating the buffers only for temporary use inside
pinmux_select().

I'll get that fixed in v3.

Thank you,
Drew