Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 31 May 2023 21:45:38 -0700
From:   Sukrut Bellary <sukrut.bellary@linux.com>
To:     Srinivas Kandagatla <srinivas.kandagatla@linaro.org>,
        Dan Carpenter <dan.carpenter@linaro.org>
Cc:     Abel Vesa <abel.vesa@linaro.org>,
        Amol Maheshwari <amahesh@qti.qualcomm.com>,
        Arnd Bergmann <arnd@arndb.de>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org,
        kernel-janitors@vger.kernel.org,
        Shuah Khan <skhan@linuxfoundation.org>
Subject: Re: [PATCH] misc: fastrpc: Fix double free of 'buf' in error path
Message-ID: <ZHgicqL/TKuXHM0o@dev-linux.lan>
References: <20230518100829.515143-1-sukrut.bellary@linux.com>
 <9194ebdf-f335-4cd6-bf89-bb4f86a57784@kili.mountain>
 <f47b17c1-1c02-2aa3-ba10-fcef70cb25a8@linaro.org>
 <b0115d7d-d15a-4948-8726-09a8b37f3f36@kili.mountain>
 <4aa42c38-e0e2-4d2d-bfe2-15bc151f7117@linaro.org>
 <ZGf+99vmXpN5nJ2f@dev-linux.lan>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <ZGf+99vmXpN5nJ2f@dev-linux.lan>
Precedence: bulk

On Fri, May 19, 2023 at 03:57:59PM -0700, Sukrut Bellary wrote:
> On Fri, May 19, 2023 at 11:39:59AM +0100, Srinivas Kandagatla wrote:
> > 
> > 
> > On 19/05/2023 11:22, Dan Carpenter wrote:
> > > > ----------------------->cut<---------------------------
> > > > diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> > > > index f60bbf99485c..3fdd326e1ae8 100644
> > > > --- a/drivers/misc/fastrpc.c
> > > > +++ b/drivers/misc/fastrpc.c
> > > > @@ -1891,7 +1891,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
> > > > char __user *argp)
> > > >                                        &args[0]);
> > > >          if (err) {
> > > >                  dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size);
> > > > -               goto err_invoke;
> > > > +               fastrpc_buf_free(buf);
> > > > +               return err;
> > > >          }
> > > > 
> > > >          /* update the buffer to be able to deallocate the memory on the DSP
> > > > */
> > > > @@ -1930,11 +1931,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
> > > > char __user *argp)
> > > >          return 0;
> > > > 
> > > >   err_assign:
> > > > -       fastrpc_req_munmap_impl(fl, buf);
> > > > -err_invoke:
> > > > -       fastrpc_buf_free(buf);
> > > > -
> > > > -       return err;
> > > > +       return fastrpc_req_munmap_impl(fl, buf);
> > > 
> > > This will return success if copy_to_user() fails.
> > > 
> > that is true, using return value of fastrpc_req_munmap_impl does not really
> > make sense here we should just return err in either case to the user.
> >
>

I have one follow-up question before I send the v2 patch.
With the following approach, I do see one issue.

----------------------->cut<---------------------------
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index f60bbf99485c..3fdd326e1ae8 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1891,7 +1891,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)
                                      &args[0]);
        if (err) {
                dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size);
-               goto err_invoke;
+               fastrpc_buf_free(buf);
+               return err;
        }

        /* update the buffer to be able to deallocate the memory on the DSP */
@@ -1930,11 +1931,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)
        return 0;

 err_assign:
-       fastrpc_req_munmap_impl(fl, buf);
-err_invoke:
-       fastrpc_buf_free(buf);
-
-       return err;
+       fastrpc_req_munmap_impl(fl, buf);
+       return err;
 }
----------------------->cut<---------------------------

In this, if qcom_scm_assign_mem() fails, the buf is not added to the list.
But the call to fastrpc_req_munmap_impl() tries to delete the buf
from the list.

To avoid this, we can use the following approach.
Here we first add the buf to the list and fastrpc_req_munmap_impl() would
take care of deleting it in the failure path
Please let me know your review comments.

----------------------->cut<---------------------------
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index f48466960f1b..56751609f412 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1882,7 +1882,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)
                                      &args[0]);
        if (err) {
                dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size);
-               goto err_invoke;
+               fastrpc_buf_free(buf);
+               return err;
        }
 
        /* update the buffer to be able to deallocate the memory on the DSP */
@@ -1890,6 +1891,9 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)
 
        /* let the client know the address to use */
        req.vaddrout = rsp_msg.vaddr;
+       spin_lock(&fl->lock);
+       list_add_tail(&buf->node, &fl->mmaps);
+       spin_unlock(&fl->lock);
 
        /* Add memory to static PD pool, protection thru hypervisor */
        if (req.flags != ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) {
@@ -1906,9 +1910,6 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)
                }
        }
 
-       spin_lock(&fl->lock);
-       list_add_tail(&buf->node, &fl->mmaps);
-       spin_unlock(&fl->lock);
 
        if (copy_to_user((void __user *)argp, &req, sizeof(req))) {
                err = -EFAULT;
@@ -1922,10 +1923,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl,
char __user *argp)
 
 err_assign:
        fastrpc_req_munmap_impl(fl, buf);
-err_invoke:
-       fastrpc_buf_free(buf);
-
        return err;
+
 }
----------------------->cut<---------------------------

Regards,
Sukrut Bellary

> Thanks, Srini and Dan, for reviewing the patch and suggestions.
> I will add this in v2.
> 
> Regards,
> Sukrut Bellary
> 
> > --srini
> > 
> > > regards,
> > > dan carpenter
> > >