Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 19 May 2023 16:39:47 -0700
From:   Sukrut Bellary <sukrut.bellary@linux.com>
To:     Dan Carpenter <dan.carpenter@linaro.org>
Cc:     Srinivas Kandagatla <srinivas.kandagatla@linaro.org>,
        Abel Vesa <abel.vesa@linaro.org>,
        Amol Maheshwari <amahesh@qti.qualcomm.com>,
        Arnd Bergmann <arnd@arndb.de>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org,
        kernel-janitors@vger.kernel.org,
        Shuah Khan <skhan@linuxfoundation.org>
Subject: Re: [PATCH] misc: fastrpc: Fix double free of 'buf' in error path
Message-ID: <ZGgIw3rzigqI92BO@dev-linux.lan>
References: <20230518100829.515143-1-sukrut.bellary@linux.com>
 <9194ebdf-f335-4cd6-bf89-bb4f86a57784@kili.mountain>
 <f47b17c1-1c02-2aa3-ba10-fcef70cb25a8@linaro.org>
 <b0115d7d-d15a-4948-8726-09a8b37f3f36@kili.mountain>
 <fa0e9d9d-6362-456b-87f7-990ccf7e8930@kili.mountain>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <fa0e9d9d-6362-456b-87f7-990ccf7e8930@kili.mountain>
Precedence: bulk

On Fri, May 19, 2023 at 01:58:10PM +0300, Dan Carpenter wrote:
> This is unrelated but I was looking through the driver and I notice
> a bunch of code doing:
> 
> grep 'return ret ?' drivers/firmware/ -R
> 
> 	return ret ? : res.result[0];
> 
> "ret" here is a kernel error code, and res.result[0] is a firmware
> error code.  Mixing error codes is a dangerous thing.  I was reviewing
> some of the callers and the firmware error code gets passed quite far
> back into the kernel to where we would only expect kernel error codes.
> 
> Presumably the firmware is returning positive error codes?  To be honest,
> I am just guessing.  It's better to convert custom error codes to kernel
> error codes as soon as possible.  I am just guessing.  Sukrut, do you
> think you could take a look?  If the callers do not differentiate
> between negative kernel error codes and positive custom error codes then
> probably just do:
> 
> 	if (res.result[0])
> 		ret = -EIO; // -EINVAL?
> 	return ret;
> 

Thanks, Dan, for sharing your findings.
Yes, sure, I will take a look.

Regards,
Sukrut Bellary

> Also there are a couple places which do:
> 
> 	return ret ? false : !!res.result[0];
> 
> Here true means success and false means failure.  So the !! converts
> a firmware error code to true when it should be false so that's a bug.
> Quadruple negatives are confusing...  It should be:
> 
> 	if (ret || res.result[0])
> 		return false;
> 	return true;
> 
> regards,
> dan carpenter
>