Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
MIME-Version: 1.0
References: <20220608011712.2371-1-xiaohuizhang@ruc.edu.cn>
In-Reply-To: <20220608011712.2371-1-xiaohuizhang@ruc.edu.cn>
From:   Andy Shevchenko <andy.shevchenko@gmail.com>
Date:   Wed, 8 Jun 2022 12:58:47 +0200
Message-ID: <CAHp75VenPBtQJ7SVMaOLqER_5HjUDUT-bdJawb3LK=n9oU+4Yg@mail.gmail.com>
Subject: Re: [PATCH 1/1] platform/x86/intel: Fix uninitialized entry in pmt_crashlog_probe
To:     Xiaohui Zhang <xiaohuizhang@ruc.edu.cn>
Cc:     "David E . Box" <david.e.box@linux.intel.com>,
        Hans de Goede <hdegoede@redhat.com>,
        Mark Gross <markgross@kernel.org>,
        Platform Driver <platform-driver-x86@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Wed, Jun 8, 2022 at 9:45 AM Xiaohui Zhang <xiaohuizhang@ruc.edu.cn> wrote:
>
> Similar to the handling of pmt_telem_probe in commit 2cdfa0c20d58
> ("platform/x86/intel: Fix 'rmmod pmt_telemetry' panic"), we thought
> a patch might be needed here as well.
>
> The probe function, pmt_crashlog_probe(), adds an entry for devices even if
> they have not been initialized.  This results in the array of initialized
> devices containing both initialized and uninitialized entries.  This
> causes a panic in the remove function, pmt_crashlog_remove() which expects
> the array to only contain initialized entries.
>
> Only use an entry when a device is initialized.

...

>         auxiliary_set_drvdata(auxdev, priv);
>
>         for (i = 0; i < intel_vsec_dev->num_resources; i++) {
> -               struct intel_pmt_entry *entry = &priv->entry[i].entry;
> +               struct intel_pmt_entry *entry = &priv->entry[priv->num_entries].entry;

This requires more explanation, what do the entry and the i mean in
the below call? Why is using the same entry over all resources fine?
num_entries as an index is pointing out of bounds, is that what was
really expected (first free entry?)?


>                 ret = intel_pmt_dev_create(entry, &pmt_crashlog_ns, intel_vsec_dev, i);
>                 if (ret < 0)


-- 
With Best Regards,
Andy Shevchenko