Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Message-ID: <629DC880.8050708@gmail.com>
Date:   Mon, 06 Jun 2022 12:27:28 +0300
From:   Eli Billauer <eli.billauer@gmail.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.12) Gecko/20100907 Fedora/3.0.7-1.fc12 Thunderbird/3.0.7
MIME-Version: 1.0
To:     Zheyu Ma <zheyuma97@gmail.com>
CC:     arnd@arndb.de, gregkh@linuxfoundation.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH v4] char: xillybus: Check endpoint type at probe time
References: <20220531054431.3978424-1-zheyuma97@gmail.com>
In-Reply-To: <20220531054431.3978424-1-zheyuma97@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 31/05/22 08:44, Zheyu Ma wrote:
>   static int xillyusb_setup_base_eps(struct xillyusb_dev *xdev)
>   {
> +	if (xillyusb_check_endpoint(xdev, IN_EP_NUM | USB_DIR_IN) ||
> +		xillyusb_check_endpoint(xdev, MSG_EP_NUM | USB_DIR_OUT))
> +		return -EINVAL;
> +
>   	xdev->msg_ep = endpoint_alloc(xdev, MSG_EP_NUM | USB_DIR_OUT,
>   				      bulk_out_work, 1, 2);
>   	if (!xdev->msg_ep)
> @@ -1962,6 +1986,10 @@ static int setup_channels(struct xillyusb_dev *xdev,
>   			chan->out_log2_element_size = out_desc&  0x0f;
>   			chan->out_log2_fifo_size =
>   				((out_desc>>  8)&  0x1f) + 16;
> +			if (xillyusb_check_endpoint(xdev, (i+2) | USB_DIR_OUT)) {
> +				kfree(xdev->channels);
> +				return -EINVAL;
> +			}
>   		}
>   	}
>
>    
I just checked this against hardware, and made it fail deliberately by 
replacing the (i+2) part with (i+3). I got a kernel memory corruption, 
because xdev->channels was freed twice: Once in the snippet above, and a 
second time in cleanup_dev().

So the kfree() call here should go away. xdev->channels is freed when 
xdev's reference count goes to zero.

Thanks,
    Eli