Date:   Thu, 6 Jan 2022 17:31:45 +0000
From:   Mark Brown <broonie@kernel.org>
To:     Fabio Estevam <festevam@gmail.com>
Cc:     matthias.schiffer@ew.tq-group.com, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] regmap: debugfs: Free the previous allocated
 debugfs_name buffer
Message-ID: <YdcngYVZwC2s+Pin@sirena.org.uk>
References: <20220106171537.3091643-1-festevam@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="uGmHJ3AUYiAioGCT"
Content-Disposition: inline
In-Reply-To: <20220106171537.3091643-1-festevam@gmail.com>
Precedence: bulk


--uGmHJ3AUYiAioGCT
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Jan 06, 2022 at 02:15:37PM -0300, Fabio Estevam wrote:

> debugfs: Directory 'dummy-iomuxc-gpr@20e0000' with parent 'regmap' alread=
y present!
>=20
> By inspecting the duplicate directory name:=20
>=20
> [    0.274418] platform panel: Fixing up cyclic dependency with ldb
> [    0.276896] ************ 1: devname is dummy
> [    0.276926] ************ 2: name is iomuxc-gpr@20e0000

It's quite hard to read these kernel logs and tie them into anything -
they're fairly verbose and weirdly formatted with all the *********s.

> +++ b/drivers/base/regmap/regmap-debugfs.c
> @@ -589,6 +589,7 @@ void regmap_debugfs_init(struct regmap *map)
>  				return;
>  		}
>  		name =3D map->debugfs_name;
> +		kfree(map->debugfs_name);
>  	} else {
>  		name =3D devname;
>  	}
> @@ -600,6 +601,7 @@ void regmap_debugfs_init(struct regmap *map)
>  		if (!map->debugfs_name)
>  				return;
>  		name =3D map->debugfs_name;
> +		kfree(map->debugfs_name);

This is fairly clearly introducing a use after free bug - we've taken a
copy of map->debugfs_name in name then immediately free map->debugfs_name
so any use of name will be referencing freed memory.  If this works it
will be because something went and zeroed the memory, it's just as
likely to cause us to crash.

--uGmHJ3AUYiAioGCT
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmHXJ4AACgkQJNaLcl1U
h9C7Cwf/cfREzK+slDlKxKwlzgyTvagPlh3Np0n2zqlMt3YRum8nByZhtUXWQzjD
qiC35DcdldJMw571dmfywMDcfBREHUZWmwFmYXiatr5d9upMV6zNUwW4Iv8izcq3
3YQNIbocUULyQ34fqtcgr1Kf0CJECT8tj1ZH5/MsBy4eDhRfHmRFHT0ZXe1qBumP
9tdisAVBzmRHZmiZeMv5CLt5Om5/c8QcQTCaKGq7X7hdXw1D1kinlAycBhW2G3Jf
sQ31oDzDzMX7o91AK4rSHzBm817V2rC2UH4nyO6qu6YCQdEw43IG/dLyzu6soFW/
a4VzAOmouXVMtXDSESM9LroxddiuoA==
=c000
-----END PGP SIGNATURE-----

--uGmHJ3AUYiAioGCT--