From patchwork Wed Oct 24 19:37:13 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Osipenko X-Patchwork-Id: 10654913 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6C15314E2 for ; Wed, 24 Oct 2018 19:38:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 53AB92AE9B for ; Wed, 24 Oct 2018 19:38:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 471662AEB4; Wed, 24 Oct 2018 19:38:37 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B8F792AE9B for ; Wed, 24 Oct 2018 19:38:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726152AbeJYEH5 (ORCPT ); Thu, 25 Oct 2018 00:07:57 -0400 Received: from mail-pl1-f196.google.com ([209.85.214.196]:36288 "EHLO mail-pl1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725994AbeJYEH5 (ORCPT ); Thu, 25 Oct 2018 00:07:57 -0400 Received: by mail-pl1-f196.google.com with SMTP id y11-v6so2709540plt.3; Wed, 24 Oct 2018 12:38:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=UQPulZTZv6CkJ1xa+bjPUNKdCn9nrIJ4wulgYItVYrw=; b=C6XCEjJNjt5fZx4cj01hIgMJ9KQcu+Kt9Q0LV5tmn5QTCU1kKPb+WXNK1w+gpRtNvQ TmBWrj6XbjfN6mj2I/TuCAsAWvRBQzyaOpIGe9+qXxQ16exaaAUF5WbSqvvhXNyeP06G /eyBt8XxRQKp38rqpc5ouj1Nxf1Fl1gsiANcxLzH8vPsQmspVRl9B6bAAOg8OVUBkz51 QeGN3rDM62FkooRgOHVaWvsVs7bYshmOJTo3zdKdF07tV4KAytdPETA2umoB0jB5oym/ y8iO/WucM1fRV6Xs9hGC1Nk6u1CZoI4OBMj7Tfzs7+SXk6WzkcykD+gdDdevmziRChzt zvXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=UQPulZTZv6CkJ1xa+bjPUNKdCn9nrIJ4wulgYItVYrw=; b=DWkAO6kb3KtE+cvM0bjUrBMtNUXoYIuueM7w1XYbzqwHVPiS3p0ayMDg5fP2pLs7PS vNobJ0HgF+khmqex1SnN/B+TLt8QWZvEzAuj95D+UwaB+YrjIzCxoNf3C2xlrQUK+pNY 5B4XBeFptwE90TvvEQQspOBnoWitGksYLf8GCdZ06b5AwdiTxc3I35rJWUyt+vA9CG6/ rkYnRw6TCKJrjKH9UKcOfBWfmid1VVzzcN9bumJBQe4EJJGzDaf0HTjtYjorXhnFj2sm lL6sAyyv1LHSRk4uvwYnBxq55FlxUlcrvMO8/i/y2PyWGFiR3nQWioGAgqAdxpNGwNmP 8MBA== X-Gm-Message-State: AGRZ1gI4pazAs8BycGbjlPHE3L7ZIsjgYOzQDzunZd9ohat7gyL/A8UT Ma34eX6f7RToP3DCdxceZqfASJEU X-Google-Smtp-Source: AJdET5d276xqb8+84AJW0xveKxyD42poACsHyX3Gaw7R6U0Vssb826ku09XF1jonu68z4CozLJQNhg== X-Received: by 2002:a17:902:bd42:: with SMTP id b2-v6mr2513334plx.148.1540409914825; Wed, 24 Oct 2018 12:38:34 -0700 (PDT) Received: from localhost.localdomain (109-252-91-118.nat.spd-mgts.ru. [109.252.91.118]) by smtp.gmail.com with ESMTPSA id i2-v6sm5779089pgq.35.2018.10.24.12.38.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Oct 2018 12:38:33 -0700 (PDT) From: Dmitry Osipenko To: Jean Delvare , Guenter Roeck Cc: Linus Walleij , linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v1] hwmon: Fix double-free in __hwmon_device_register() Date: Wed, 24 Oct 2018 22:37:13 +0300 Message-Id: <20181024193713.15625-1-digetx@gmail.com> X-Mailer: git-send-email 2.19.0 MIME-Version: 1.0 Sender: linux-hwmon-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-hwmon@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Fix double-free that happens when thermal zone setup fails, see KASAN log below. ================================================================== BUG: KASAN: double-free or invalid-free in __hwmon_device_register+0x5dc/0xa7c CPU: 0 PID: 132 Comm: kworker/0:2 Tainted: G B 4.19.0-rc8-next-20181016-00042-gb52cd80401e9-dirty #41 Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) Workqueue: events deferred_probe_work_func Backtrace: [] (dump_backtrace) from [] (show_stack+0x20/0x24) [] (show_stack) from [] (dump_stack+0x9c/0xb0) [] (dump_stack) from [] (print_address_description+0x68/0x250) [] (print_address_description) from [] (kasan_report_invalid_free+0x68/0x88) [] (kasan_report_invalid_free) from [] (__kasan_slab_free+0x1f4/0x200) [] (__kasan_slab_free) from [] (kasan_slab_free+0x14/0x18) [] (kasan_slab_free) from [] (kfree+0x90/0x294) [] (kfree) from [] (__hwmon_device_register+0x5dc/0xa7c) [] (__hwmon_device_register) from [] (hwmon_device_register_with_info+0xa0/0xa8) [] (hwmon_device_register_with_info) from [] (devm_hwmon_device_register_with_info+0x74/0xb4) [] (devm_hwmon_device_register_with_info) from [] (lm90_probe+0x414/0x578) [] (lm90_probe) from [] (i2c_device_probe+0x35c/0x384) [] (i2c_device_probe) from [] (really_probe+0x290/0x3e4) [] (really_probe) from [] (driver_probe_device+0x80/0x1c4) [] (driver_probe_device) from [] (__device_attach_driver+0x104/0x11c) [] (__device_attach_driver) from [] (bus_for_each_drv+0xa4/0xc8) [] (bus_for_each_drv) from [] (__device_attach+0xf0/0x15c) [] (__device_attach) from [] (device_initial_probe+0x1c/0x20) [] (device_initial_probe) from [] (bus_probe_device+0xdc/0xec) [] (bus_probe_device) from [] (deferred_probe_work_func+0xa8/0xd4) [] (deferred_probe_work_func) from [] (process_one_work+0x3dc/0x96c) [] (process_one_work) from [] (worker_thread+0x4ec/0x8bc) [] (worker_thread) from [] (kthread+0x230/0x240) [] (kthread) from [] (ret_from_fork+0x14/0x38) Exception stack(0xcf743fb0 to 0xcf743ff8) 3fa0: 00000000 00000000 00000000 00000000 3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 Allocated by task 132: kasan_kmalloc.part.1+0x58/0xf4 kasan_kmalloc+0x90/0xa4 kmem_cache_alloc_trace+0x90/0x2a0 __hwmon_device_register+0xbc/0xa7c hwmon_device_register_with_info+0xa0/0xa8 devm_hwmon_device_register_with_info+0x74/0xb4 lm90_probe+0x414/0x578 i2c_device_probe+0x35c/0x384 really_probe+0x290/0x3e4 driver_probe_device+0x80/0x1c4 __device_attach_driver+0x104/0x11c bus_for_each_drv+0xa4/0xc8 __device_attach+0xf0/0x15c device_initial_probe+0x1c/0x20 bus_probe_device+0xdc/0xec deferred_probe_work_func+0xa8/0xd4 process_one_work+0x3dc/0x96c worker_thread+0x4ec/0x8bc kthread+0x230/0x240 ret_from_fork+0x14/0x38 (null) Freed by task 132: __kasan_slab_free+0x12c/0x200 kasan_slab_free+0x14/0x18 kfree+0x90/0x294 hwmon_dev_release+0x1c/0x20 device_release+0x4c/0xe8 kobject_put+0xac/0x11c device_unregister+0x2c/0x30 __hwmon_device_register+0xa58/0xa7c hwmon_device_register_with_info+0xa0/0xa8 devm_hwmon_device_register_with_info+0x74/0xb4 lm90_probe+0x414/0x578 i2c_device_probe+0x35c/0x384 really_probe+0x290/0x3e4 driver_probe_device+0x80/0x1c4 __device_attach_driver+0x104/0x11c bus_for_each_drv+0xa4/0xc8 __device_attach+0xf0/0x15c device_initial_probe+0x1c/0x20 bus_probe_device+0xdc/0xec deferred_probe_work_func+0xa8/0xd4 process_one_work+0x3dc/0x96c worker_thread+0x4ec/0x8bc kthread+0x230/0x240 ret_from_fork+0x14/0x38 (null) Cc: # v4.15+ Fixes: 47c332deb8e8 ("hwmon: Deal with errors from the thermal subsystem") Signed-off-by: Dmitry Osipenko --- drivers/hwmon/hwmon.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c index 975c95169884..84f61cec6319 100644 --- a/drivers/hwmon/hwmon.c +++ b/drivers/hwmon/hwmon.c @@ -649,8 +649,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, if (info[i]->config[j] & HWMON_T_INPUT) { err = hwmon_thermal_add_sensor(dev, hwdev, j); - if (err) - goto free_device; + if (err) { + device_unregister(hdev); + goto ida_remove; + } } } } @@ -658,8 +660,6 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, return hdev; -free_device: - device_unregister(hdev); free_hwmon: kfree(hwdev); ida_remove: