| Message ID | 20250312095251.2554708-3-michal.swiatkowski@linux.intel.com (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | fix xa_alloc_cyclic() return checks | expand |
On 12/03/2025 09:52, Michal Swiatkowski wrote: > In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will > be returned, which will cause IS_ERR() to be false. Which can lead to > dereference not allocated pointer (pin). > > Fix it by checking if err is lower than zero. > > This wasn't found in real usecase, only noticed. Credit to Pierre. > > Fixes: 97f265ef7f5b ("dpll: allocate pin ids in cycle") > Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> > --- > drivers/dpll/dpll_core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c > index 32019dc33cca..1877201d1aa9 100644 > --- a/drivers/dpll/dpll_core.c > +++ b/drivers/dpll/dpll_core.c > @@ -505,7 +505,7 @@ dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module *module, > xa_init_flags(&pin->parent_refs, XA_FLAGS_ALLOC); > ret = xa_alloc_cyclic(&dpll_pin_xa, &pin->id, pin, xa_limit_32b, > &dpll_pin_xa_id, GFP_KERNEL); > - if (ret) > + if (ret < 0) > goto err_xa_alloc; > return pin; > err_xa_alloc: Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
>From: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> >Sent: Wednesday, March 12, 2025 10:53 AM > >In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will >be returned, which will cause IS_ERR() to be false. Which can lead to >dereference not allocated pointer (pin). > >Fix it by checking if err is lower than zero. > >This wasn't found in real usecase, only noticed. Credit to Pierre. > >Fixes: 97f265ef7f5b ("dpll: allocate pin ids in cycle") >Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> >--- > drivers/dpll/dpll_core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c >index 32019dc33cca..1877201d1aa9 100644 >--- a/drivers/dpll/dpll_core.c >+++ b/drivers/dpll/dpll_core.c >@@ -505,7 +505,7 @@ dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module >*module, > xa_init_flags(&pin->parent_refs, XA_FLAGS_ALLOC); > ret = xa_alloc_cyclic(&dpll_pin_xa, &pin->id, pin, xa_limit_32b, > &dpll_pin_xa_id, GFP_KERNEL); >- if (ret) >+ if (ret < 0) > goto err_xa_alloc; > return pin; > err_xa_alloc: >-- >2.42.0 LGTM, Thanks! Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c index 32019dc33cca..1877201d1aa9 100644 --- a/drivers/dpll/dpll_core.c +++ b/drivers/dpll/dpll_core.c @@ -505,7 +505,7 @@ dpll_pin_alloc(u64 clock_id, u32 pin_idx, struct module *module, xa_init_flags(&pin->parent_refs, XA_FLAGS_ALLOC); ret = xa_alloc_cyclic(&dpll_pin_xa, &pin->id, pin, xa_limit_32b, &dpll_pin_xa_id, GFP_KERNEL); - if (ret) + if (ret < 0) goto err_xa_alloc; return pin; err_xa_alloc:
In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will be returned, which will cause IS_ERR() to be false. Which can lead to dereference not allocated pointer (pin). Fix it by checking if err is lower than zero. This wasn't found in real usecase, only noticed. Credit to Pierre. Fixes: 97f265ef7f5b ("dpll: allocate pin ids in cycle") Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> --- drivers/dpll/dpll_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)