From patchwork Fri Feb 19 08:58:25 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexandru Ardelean X-Patchwork-Id: 12094841 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E6BBAC433DB for ; Fri, 19 Feb 2021 09:02:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 99AFA64EAF for ; Fri, 19 Feb 2021 09:02:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229799AbhBSJCG (ORCPT ); Fri, 19 Feb 2021 04:02:06 -0500 Received: from mx0a-00128a01.pphosted.com ([148.163.135.77]:37156 "EHLO mx0a-00128a01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229527AbhBSJCG (ORCPT ); Fri, 19 Feb 2021 04:02:06 -0500 Received: from pps.filterd (m0167089.ppops.net [127.0.0.1]) by mx0a-00128a01.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 11J8teSP000406; Fri, 19 Feb 2021 04:01:13 -0500 Received: from nwd2mta4.analog.com ([137.71.173.58]) by mx0a-00128a01.pphosted.com with ESMTP id 36pcjb1q8c-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 19 Feb 2021 04:01:13 -0500 Received: from ASHBMBX8.ad.analog.com (ASHBMBX8.ad.analog.com [10.64.17.5]) by nwd2mta4.analog.com (8.14.7/8.14.7) with ESMTP id 11J91C5U047822 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Fri, 19 Feb 2021 04:01:12 -0500 Received: from ASHBCASHYB5.ad.analog.com (10.64.17.133) by ASHBMBX8.ad.analog.com (10.64.17.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.721.2; Fri, 19 Feb 2021 04:01:08 -0500 Received: from ASHBMBX8.ad.analog.com (10.64.17.5) by ASHBCASHYB5.ad.analog.com (10.64.17.133) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.721.2; Fri, 19 Feb 2021 04:01:08 -0500 Received: from zeus.spd.analog.com (10.66.68.11) by ashbmbx8.ad.analog.com (10.64.17.5) with Microsoft SMTP Server id 15.2.721.2 via Frontend Transport; Fri, 19 Feb 2021 04:01:08 -0500 Received: from saturn.ad.analog.com ([10.48.65.120]) by zeus.spd.analog.com (8.15.1/8.15.1) with ESMTP id 11J8wx49029584; Fri, 19 Feb 2021 03:59:01 -0500 From: Alexandru Ardelean To: , CC: , , , , , Alexandru Ardelean Subject: [PATCH 1/2] iio: core: use kfree_const in iio_free_chan_devattr_list() to free names Date: Fri, 19 Feb 2021 10:58:25 +0200 Message-ID: <20210219085826.46622-2-alexandru.ardelean@analog.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20210219085826.46622-1-alexandru.ardelean@analog.com> References: <20210219085826.46622-1-alexandru.ardelean@analog.com> MIME-Version: 1.0 X-ADIRuleOP-NewSCL: Rule Triggered X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.369,18.0.761 definitions=2021-02-19_02:2021-02-18,2021-02-19 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 priorityscore=1501 impostorscore=0 spamscore=0 bulkscore=0 mlxscore=0 malwarescore=0 suspectscore=0 adultscore=0 clxscore=1015 phishscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2102190070 Precedence: bulk List-ID: X-Mailing-List: linux-iio@vger.kernel.org When the buffer attributes were wrapped in iio_dev_attr types, I forgot to duplicate the names, so that when iio_free_chan_devattr_list() gets called on cleanup, these get free'd. I stumbled over this while accidentally breaking a driver doing iio_device_register(), and then the issue appeared. The fix can be just 1. Just use kstrdup() during iio_buffer_wrap_attr() 2. Just use kfree_const() during iio_free_chan_devattr_list 3. Use both kstrdup_const() & kfree_const() (in the places mentioned above) Using kfree_const() should be sufficient, as the attribute names will either be allocated or be stored in rodata. Fixes: a1a11142f66c ("iio: buffer: wrap all buffer attributes into iio_dev_attr") Signed-off-by: Alexandru Ardelean --- drivers/iio/industrialio-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c index 0d8c6e88d993..cb2735d2ae4b 100644 --- a/drivers/iio/industrialio-core.c +++ b/drivers/iio/industrialio-core.c @@ -1358,7 +1358,7 @@ void iio_free_chan_devattr_list(struct list_head *attr_list) struct iio_dev_attr *p, *n; list_for_each_entry_safe(p, n, attr_list, l) { - kfree(p->dev_attr.attr.name); + kfree_const(p->dev_attr.attr.name); list_del(&p->l); kfree(p); } From patchwork Fri Feb 19 08:58:26 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexandru Ardelean X-Patchwork-Id: 12094839 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CAC20C433DB for ; Fri, 19 Feb 2021 09:00:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7497A64EB7 for ; Fri, 19 Feb 2021 09:00:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229678AbhBSJAE (ORCPT ); Fri, 19 Feb 2021 04:00:04 -0500 Received: from mx0a-00128a01.pphosted.com ([148.163.135.77]:22060 "EHLO mx0a-00128a01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229625AbhBSJAB (ORCPT ); Fri, 19 Feb 2021 04:00:01 -0500 Received: from pps.filterd (m0167088.ppops.net [127.0.0.1]) by mx0a-00128a01.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 11J8soAt028727; Fri, 19 Feb 2021 03:59:08 -0500 Received: from nwd2mta3.analog.com ([137.71.173.56]) by mx0a-00128a01.pphosted.com with ESMTP id 36p9gb9was-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 19 Feb 2021 03:59:08 -0500 Received: from SCSQMBX10.ad.analog.com (SCSQMBX10.ad.analog.com [10.77.17.5]) by nwd2mta3.analog.com (8.14.7/8.14.7) with ESMTP id 11J8x6ts010908 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Fri, 19 Feb 2021 03:59:07 -0500 Received: from SCSQMBX10.ad.analog.com (10.77.17.5) by SCSQMBX10.ad.analog.com (10.77.17.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.721.2; Fri, 19 Feb 2021 00:59:05 -0800 Received: from zeus.spd.analog.com (10.66.68.11) by scsqmbx10.ad.analog.com (10.77.17.5) with Microsoft SMTP Server id 15.2.721.2 via Frontend Transport; Fri, 19 Feb 2021 00:59:05 -0800 Received: from saturn.ad.analog.com ([10.48.65.120]) by zeus.spd.analog.com (8.15.1/8.15.1) with ESMTP id 11J8wx4A029584; Fri, 19 Feb 2021 03:59:02 -0500 From: Alexandru Ardelean To: , CC: , , , , , Alexandru Ardelean , kernel test robot Subject: [PATCH 2/2] iio: buffer-dma: fix type of 'i' in iio_dma_buffer_alloc_blocks() Date: Fri, 19 Feb 2021 10:58:26 +0200 Message-ID: <20210219085826.46622-3-alexandru.ardelean@analog.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20210219085826.46622-1-alexandru.ardelean@analog.com> References: <20210219085826.46622-1-alexandru.ardelean@analog.com> MIME-Version: 1.0 X-ADIRuleOP-NewSCL: Rule Triggered X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.369,18.0.761 definitions=2021-02-19_02:2021-02-18,2021-02-19 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 mlxlogscore=999 phishscore=0 clxscore=1015 mlxscore=0 priorityscore=1501 impostorscore=0 adultscore=0 spamscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2102190070 Precedence: bulk List-ID: X-Mailing-List: linux-iio@vger.kernel.org When unwinding the cleanup of the blocks, the type of 'i' is important to be signed, so that the 'i >= 0' condition doesn't underflow and infinitely loop (or just cause an access violation). Fixes: ab925b044cfb ("iio: buffer-dma: Add mmap support") Reported-by: kernel test robot Signed-off-by: Alexandru Ardelean --- drivers/iio/buffer/industrialio-buffer-dma.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/iio/buffer/industrialio-buffer-dma.c b/drivers/iio/buffer/industrialio-buffer-dma.c index d04479194cb4..83074d060535 100644 --- a/drivers/iio/buffer/industrialio-buffer-dma.c +++ b/drivers/iio/buffer/industrialio-buffer-dma.c @@ -707,8 +707,7 @@ int iio_dma_buffer_alloc_blocks(struct iio_buffer *buffer, struct iio_dma_buffer_queue *queue = iio_buffer_to_queue(buffer); struct iio_dma_buffer_block **blocks; unsigned int num_blocks; - unsigned int i; - int ret = 0; + int i, ret = 0; mutex_lock(&queue->lock);