From patchwork Wed Jan 21 15:55:21 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thierry Reding X-Patchwork-Id: 5678621 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 6E2009F333 for ; Wed, 21 Jan 2015 15:58:10 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 8D348204CF for ; Wed, 21 Jan 2015 15:58:09 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 7C1DB204D2 for ; Wed, 21 Jan 2015 15:58:08 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1YDxdl-0005ld-7d; Wed, 21 Jan 2015 15:56:21 +0000 Received: from hqemgate16.nvidia.com ([216.228.121.65]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1YDxdO-0005Nu-PX for linux-arm-kernel@lists.infradead.org; Wed, 21 Jan 2015 15:55:59 +0000 Received: from hqnvupgp07.nvidia.com (Not Verified[216.228.121.13]) by hqemgate16.nvidia.com id ; Wed, 21 Jan 2015 07:55:37 -0800 Received: from HQMAIL108.nvidia.com ([172.20.12.94]) by hqnvupgp07.nvidia.com (PGP Universal service); Wed, 21 Jan 2015 07:46:21 -0800 X-PGP-Universal: processed; by hqnvupgp07.nvidia.com on Wed, 21 Jan 2015 07:46:21 -0800 Received: from UKMAIL101.nvidia.com (10.26.138.13) by HQMAIL108.nvidia.com (172.18.146.13) with Microsoft SMTP Server (TLS) id 15.0.847.32; Wed, 21 Jan 2015 15:55:39 +0000 Received: from localhost (10.2.68.160) by UKMAIL101.nvidia.com (10.26.138.13) with Microsoft SMTP Server (TLS) id 15.0.847.32; Wed, 21 Jan 2015 15:55:25 +0000 Date: Wed, 21 Jan 2015 16:55:21 +0100 From: Thierry Reding To: Tejun Heo Subject: Re: next-20150120 broken on Tegra by "ata: libahci: Allow using multiple regulators" Message-ID: <20150121155519.GA25166@ulmo.nvidia.com> References: <20150121105001.GA9921@ulmo.nvidia.com> <20150121123134.GD8684@htj.dyndns.org> MIME-Version: 1.0 In-Reply-To: <20150121123134.GD8684@htj.dyndns.org> X-NVConfidentiality: public User-Agent: Mutt/1.5.23 (2014-03-12) X-Originating-IP: [10.2.68.160] X-ClientProxiedBy: UKMAIL102.nvidia.com (10.26.138.15) To UKMAIL101.nvidia.com (10.26.138.13) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20150121_075558_889018_5F4C3EE6 X-CRM114-Status: GOOD ( 20.97 ) X-Spam-Score: -5.0 (-----) Cc: Paul Walmsley , linux-tegra@vger.kernel.org, linux-ide@vger.kernel.org, linux-kernel@vger.kernel.org, hdegoede@redhat.com, linux-next@vger.kernel.org, pwalmsley@nvidia.com, gregory.clement@free-electrons.com, linux-arm-kernel@lists.infradead.org X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Wed, Jan 21, 2015 at 07:31:34AM -0500, Tejun Heo wrote: > On Wed, Jan 21, 2015 at 11:50:03AM +0100, Thierry Reding wrote: > > Tejun, preferably the attached patch should be squashed into commit > > c7d7ddee7e24 ("ata: libahci: Allow using multiple regulators") to avoid > > breaking bisectability. If you don't want to rewrite history, let me > > know and I can turn it into a proper patch. > > Yes, please make it a proper patch. > > Thanks a lot! Attaching the patch. Thierry From a4f78e3ec05f1b2ad86aa44d6bd5394d75a23a06 Mon Sep 17 00:00:00 2001 From: Thierry Reding Date: Wed, 21 Jan 2015 11:50:52 +0100 Subject: [PATCH] ata: libahci: Fix devres cleanup on failure Commit c7d7ddee7e24 ("ata: libahci: Allow using multiple regulators") releases regulators during ahci_platform_put_resources(). That doesn't work because the function is run as part of the devres machinery. Such resources are torn down in reverse order. Since the array that holds pointers to the regulators is allocated using devres after the device context to which ahci_platform_put_resources() is attached, the memory will be freed before calling ahci_platform_put_resources() and thereby causing a use-after-free error. This commit fixes this by using regular allocations for the array. The memory can then be freed after the regulators have been released. This conserves the advantages of using the managed API. Reported-by: Paul Walmsley Signed-off-by: Thierry Reding --- drivers/ata/libahci_platform.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c index 73a086664ee7..504d534ccbfe 100644 --- a/drivers/ata/libahci_platform.c +++ b/drivers/ata/libahci_platform.c @@ -276,6 +276,7 @@ static void ahci_platform_put_resources(struct device *dev, void *res) if (hpriv->target_pwrs && hpriv->target_pwrs[c]) regulator_put(hpriv->target_pwrs[c]); + kfree(hpriv->target_pwrs); } static int ahci_platform_get_phy(struct ahci_host_priv *hpriv, u32 port, @@ -412,7 +413,7 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev) goto err_out; } sz = hpriv->nports * sizeof(*hpriv->target_pwrs); - hpriv->target_pwrs = devm_kzalloc(dev, sz, GFP_KERNEL); + hpriv->target_pwrs = kzalloc(sz, GFP_KERNEL); if (!hpriv->target_pwrs) { rc = -ENOMEM; goto err_out; -- 2.1.3