Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 11 Feb 2021 19:41:11 -0800
From:   Drew Fustini <drew@beagleboard.org>
To:     Dan Carpenter <dan.carpenter@oracle.com>
Cc:     Linus Walleij <linus.walleij@linaro.org>,
        linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org,
        Tony Lindgren <tony@atomide.com>,
        Andy Shevchenko <andy.shevchenko@gmail.com>,
        Alexandre Belloni <alexandre.belloni@bootlin.com>,
        Geert Uytterhoeven <geert@linux-m68k.org>,
        Pantelis Antoniou <pantelis.antoniou@konsulko.com>,
        Jason Kridner <jkridner@beagleboard.org>,
        Robert Nelson <robertcnelson@beagleboard.org>,
        Joe Perches <joe@perches.com>
Subject: Re: [PATCH v4 2/2] pinctrl: pinmux: Add pinmux-select debugfs file
Message-ID: <20210212034111.GD347396@x1>
References: <20210210222851.232374-1-drew@beagleboard.org>
 <20210210222851.232374-3-drew@beagleboard.org>
 <20210211120051.GN20820@kadam>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210211120051.GN20820@kadam>
Precedence: bulk

On Thu, Feb 11, 2021 at 03:00:51PM +0300, Dan Carpenter wrote:
> On Wed, Feb 10, 2021 at 02:28:54PM -0800, Drew Fustini wrote:
> > Add "pinmux-select" to debugfs which will activate a function and group
> > when "<function-name group-name>" are written to the file. The write
> > operation pinmux_select() handles this by checking that the names map to
> > valid selectors and then calling ops->set_mux().
> > 
> > The existing "pinmux-functions" debugfs file lists the pin functions
> > registered for the pin controller. For example:
> > 
> > function: pinmux-uart0, groups = [ pinmux-uart0-pins ]
> > function: pinmux-mmc0, groups = [ pinmux-mmc0-pins ]
> > function: pinmux-mmc1, groups = [ pinmux-mmc1-pins ]
> > function: pinmux-i2c0, groups = [ pinmux-i2c0-pins ]
> > function: pinmux-i2c1, groups = [ pinmux-i2c1-pins ]
> > function: pinmux-spi1, groups = [ pinmux-spi1-pins ]
> > 
> > To activate function pinmux-i2c1 and group pinmux-i2c1-pins:
> > 
> > echo "pinmux-i2c1 pinmux-i2c1-pins" > pinmux-select
> > 
> > Signed-off-by: Drew Fustini <drew@beagleboard.org>
> > ---
> >  drivers/pinctrl/pinmux.c | 107 +++++++++++++++++++++++++++++++++++++++
> >  1 file changed, 107 insertions(+)
> > 
> > diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c
> > index c651b2db0925..23fa32f0a067 100644
> > --- a/drivers/pinctrl/pinmux.c
> > +++ b/drivers/pinctrl/pinmux.c
> > @@ -673,6 +673,111 @@ void pinmux_show_setting(struct seq_file *s,
> >  DEFINE_SHOW_ATTRIBUTE(pinmux_functions);
> >  DEFINE_SHOW_ATTRIBUTE(pinmux_pins);
> >  
> > +#define PINMUX_MAX_NAME 64
> > +static ssize_t pinmux_select(struct file *file, const char __user *user_buf,
> > +				   size_t len, loff_t *ppos)
> > +{
> > +	struct seq_file *sfile = file->private_data;
> > +	struct pinctrl_dev *pctldev = sfile->private;
> > +	const struct pinmux_ops *pmxops = pctldev->desc->pmxops;
> > +	const char *const *groups;
> > +	char *buf, *fname, *gname;
> > +	unsigned int num_groups;
> > +	int fsel, gsel, ret;
> > +
> > +	if (len > (PINMUX_MAX_NAME * 2)) {
> > +		dev_err(pctldev->dev, "write too big for buffer");
> > +		return -EINVAL;
> > +	}
> > +
> > +	buf = kzalloc(PINMUX_MAX_NAME * 2, GFP_KERNEL);
> > +	if (!buf)
> > +		return -ENOMEM;
> > +
> > +	fname = kzalloc(PINMUX_MAX_NAME, GFP_KERNEL);
> > +	if (!fname) {
> > +		ret = -ENOMEM;
> > +		goto free_buf;
> > +	}
> > +
> > +	gname = kzalloc(PINMUX_MAX_NAME, GFP_KERNEL);
> > +	if (!buf) {
> > +		ret = -ENOMEM;
> > +		goto free_fname;
> > +	}
> > +
> > +	ret = strncpy_from_user(buf, user_buf, PINMUX_MAX_NAME * 2);
> > +	if (ret < 0) {
> > +		dev_err(pctldev->dev, "failed to copy buffer from userspace");
> > +		goto free_gname;
> > +	}
> > +	buf[len-1] = '\0';
> > +
> > +	ret = sscanf(buf, "%s %s", fname, gname);
> > +	if (ret != 2) {
> > +		dev_err(pctldev->dev, "expected format: <function-name> <group-name>");
> > +		goto free_gname;
> > +	}
> > +
> > +	fsel = pinmux_func_name_to_selector(pctldev, fname);
> > +	if (fsel < 0) {
> > +		dev_err(pctldev->dev, "invalid function %s in map table\n", fname);
> > +		ret = -EINVAL;
> > +		goto free_gname;
> > +	}
> > +
> > +	ret = pmxops->get_function_groups(pctldev, fsel, &groups, &num_groups);
> > +	if (ret) {
> > +		dev_err(pctldev->dev, "no groups for function %d (%s)", fsel, fname);
> > +		goto free_gname;
> > +
> > +	}
> > +
> > +	ret = match_string(groups, num_groups, gname);
> > +	if (ret < 0) {
> > +		dev_err(pctldev->dev, "invalid group %s", gname);
> > +		goto free_gname;
> > +	}
> > +
> > +	ret = pinctrl_get_group_selector(pctldev, gname);
> > +	if (ret < 0) {
> > +		dev_err(pctldev->dev, "failed to get group selectorL %s", gname);
> > +		goto free_gname;
> > +	}
> > +	gsel = ret;
> > +
> > +	ret = pmxops->set_mux(pctldev, fsel, gsel);
> > +	if (ret) {
> > +		dev_err(pctldev->dev, "set_mux() failed: %d", ret);
> > +		goto free_gname;
> > +	}
> > +
> > +	return len;
> > +
> > +free_gname:
> > +	devm_kfree(pctldev->dev, gname);
> > +free_fname:
> > +	devm_kfree(pctldev->dev, fname);
> > +free_buf:
> > +	devm_kfree(pctldev->dev, buf);
> 
> Ugh...  I honestly thought Smatch was supposed to print a warning when
> you used devm_kfree() on kzalloc()ed memory, but I guess the warning is
> only the other way around.
> 
> Smatch does complain about it as a leak because it was expecting a
> regular free.
> 
> drivers/pinctrl/pinmux.c:330 pinmux_func_name_to_selector() warn: potential NULL parameter dereference 'fname'
> drivers/pinctrl/pinmux.c:764 pinmux_select() warn: possible memory leak of 'gname'
> drivers/pinctrl/pinmux.c:764 pinmux_select() warn: sscanf doesn't return error codes
> drivers/pinctrl/pinmux.c:764 pinmux_select() warn: returning success when sscanf failed

Thank you pointing this out.  I should have switched back to normal free
now that I no longer using a device managed buffer.

> 
> And what about the success path?  Shouldn't we free these on the success
> path as well?

Good point.  That is my fault.  I will update it so that it correctly
free's buffer no matter what happens in the function.


thanks,
drew