From patchwork Mon Feb 18 10:15:57 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krzysztof Kozlowski X-Patchwork-Id: 10817667 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1F03417FB for ; Mon, 18 Feb 2019 10:17:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0D6492A378 for ; Mon, 18 Feb 2019 10:17:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 01A1D2A39B; Mon, 18 Feb 2019 10:17:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B06C72A378 for ; Mon, 18 Feb 2019 10:17:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729916AbfBRKQy (ORCPT ); Mon, 18 Feb 2019 05:16:54 -0500 Received: from mail.kernel.org ([198.145.29.99]:60770 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727004AbfBRKQx (ORCPT ); Mon, 18 Feb 2019 05:16:53 -0500 Received: from PC-kkoz.proceq.com (unknown [213.160.61.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7B42A217D7; Mon, 18 Feb 2019 10:16:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1550485012; bh=kS/J/urVPv8KaqJyXGSwGWNgmhUo4x7oiE8lPhxGrNU=; h=From:To:Subject:Date:In-Reply-To:References:From; b=d4p1zVd2V8lWfqGbIHW9eNKd52fEGSLClTla5v/iFj5yUyn0NPXi33mYCKM+bpGBF jXcl4kGQrgEWx9RO8JGV9PMjQiy33ElDHanqPtEa8d4KmARuIfwC3lZuzaZUjDRCmy QJPSG1rnwFyBoh4+jzemRNioaJOBn8JPHTXsFWjk= From: Krzysztof Kozlowski To: Russell King , Mark Brown , linux-kernel@vger.kernel.org, linux-spi@vger.kernel.org, Greg Kroah-Hartman , "Rafael J. Wysocki" , Sylwester Nawrocki , Tomasz Figa , Chanwoo Choi , Michael Turquette , Stephen Boyd , Kukjin Kim , Krzysztof Kozlowski , Andy Gross , David Brown , Srinivas Kandagatla , linux-samsung-soc@vger.kernel.org, linux-clk@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-arm-msm@vger.kernel.org, alsa-devel@alsa-project.org Subject: [RFC 1/4] clk: samsung: exynos5: Fix possible NULL pointer exception on platform_device_alloc() failure Date: Mon, 18 Feb 2019 11:15:57 +0100 Message-Id: <1550484960-2392-2-git-send-email-krzk@kernel.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1550484960-2392-1-git-send-email-krzk@kernel.org> References: <1550484960-2392-1-git-send-email-krzk@kernel.org> Sender: linux-arm-msm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP During initialization of subdevices if platform_device_alloc() failed, returned NULL pointer will be later dereferenced. Add proper error paths to exynos5_clk_register_subcmu(). The return value of this function is still ignored because at this stage of init there is nothing we can do. Signed-off-by: Krzysztof Kozlowski --- drivers/clk/samsung/clk-exynos5-subcmu.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/clk/samsung/clk-exynos5-subcmu.c b/drivers/clk/samsung/clk-exynos5-subcmu.c index 93306283d764..d07ef26bd052 100644 --- a/drivers/clk/samsung/clk-exynos5-subcmu.c +++ b/drivers/clk/samsung/clk-exynos5-subcmu.c @@ -136,15 +136,21 @@ static int __init exynos5_clk_register_subcmu(struct device *parent, { struct of_phandle_args genpdspec = { .np = pd_node }; struct platform_device *pdev; + int ret; pdev = platform_device_alloc(info->pd_name, -1); + if (!pdev) + return -ENOMEM; + pdev->dev.parent = parent; pdev->driver_override = "exynos5-subcmu"; platform_set_drvdata(pdev, (void *)info); of_genpd_add_device(&genpdspec, &pdev->dev); - platform_device_add(pdev); + ret = platform_device_add(pdev); + if (ret) + platform_device_put(pdev); - return 0; + return ret; } static int __init exynos5_clk_probe(struct platform_device *pdev) From patchwork Mon Feb 18 10:15:58 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krzysztof Kozlowski X-Patchwork-Id: 10817717 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 526AA184E for ; Mon, 18 Feb 2019 10:18:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4362B2A378 for ; Mon, 18 Feb 2019 10:18:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 36DDB2A380; Mon, 18 Feb 2019 10:18:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B25F72A397 for ; Mon, 18 Feb 2019 10:18:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729135AbfBRKR5 (ORCPT ); Mon, 18 Feb 2019 05:17:57 -0500 Received: from mail.kernel.org ([198.145.29.99]:60904 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729955AbfBRKQ6 (ORCPT ); Mon, 18 Feb 2019 05:16:58 -0500 Received: from PC-kkoz.proceq.com (unknown [213.160.61.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 37F4A2173C; Mon, 18 Feb 2019 10:16:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1550485016; bh=//l0wrvBNnBguAPChDNn+Giq2JtujExleOSWOJF6kP8=; h=From:To:Subject:Date:In-Reply-To:References:From; b=J34NQ7Nv3UC/+2wBMA8htEraZlsaPTGhfIDzarQphdp155lK+RFVmZf0bT4HTeo+O l9vX4ytPjUYGWPYpHE82/rI6T86XZnQ9j5FOBeacw/kbKRBnx2WSm94TloxXpFYFnJ C+hkebNdCxPwZb1PFEkn2R1iRNHditPUvlclzjkg= From: Krzysztof Kozlowski To: Russell King , Mark Brown , linux-kernel@vger.kernel.org, linux-spi@vger.kernel.org, Greg Kroah-Hartman , "Rafael J. Wysocki" , Sylwester Nawrocki , Tomasz Figa , Chanwoo Choi , Michael Turquette , Stephen Boyd , Kukjin Kim , Krzysztof Kozlowski , Andy Gross , David Brown , Srinivas Kandagatla , linux-samsung-soc@vger.kernel.org, linux-clk@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-arm-msm@vger.kernel.org, alsa-devel@alsa-project.org Subject: [RFC 2/4] driver: platform: Provide helper for safer setting of driver_override Date: Mon, 18 Feb 2019 11:15:58 +0100 Message-Id: <1550484960-2392-3-git-send-email-krzk@kernel.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1550484960-2392-1-git-send-email-krzk@kernel.org> References: <1550484960-2392-1-git-send-email-krzk@kernel.org> Sender: linux-arm-msm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The core platform driver expects that driver_override is an dynamically allocated memory so later it can kfree() it. However such assumption is not documented and there are already users setting it to a const memory. This leads to kfree() of const memory during device release (e.g. in error paths or during unbind): kernel BUG at ../mm/slub.c:3960! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM ... (kfree) from [] (platform_device_release+0x88/0xb4) (platform_device_release) from [] (device_release+0x2c/0x90) (device_release) from [] (kobject_put+0xec/0x20c) (kobject_put) from [] (exynos5_clk_probe+0x154/0x18c) (exynos5_clk_probe) from [] (platform_drv_probe+0x6c/0xa4) (platform_drv_probe) from [] (really_probe+0x280/0x414) (really_probe) from [] (driver_probe_device+0x78/0x1c4) (driver_probe_device) from [] (bus_for_each_drv+0x74/0xb8) (bus_for_each_drv) from [] (__device_attach+0xd4/0x16c) (__device_attach) from [] (bus_probe_device+0x88/0x90) (bus_probe_device) from [] (device_add+0x3dc/0x62c) (device_add) from [] (of_platform_device_create_pdata+0x94/0xbc) (of_platform_device_create_pdata) from [] (of_platform_bus_create+0x1a8/0x4fc) (of_platform_bus_create) from [] (of_platform_bus_create+0x20c/0x4fc) (of_platform_bus_create) from [] (of_platform_populate+0x84/0x118) (of_platform_populate) from [] (of_platform_default_populate_init+0xa0/0xb8) (of_platform_default_populate_init) from [] (do_one_initcall+0x8c/0x404) (do_one_initcall) from [] (kernel_init_freeable+0x3d0/0x4d8) (kernel_init_freeable) from [] (kernel_init+0x8/0x114) (kernel_init) from [] (ret_from_fork+0x14/0x20) Provide a helper which clearly documents the usage of driver_override. Signed-off-by: Krzysztof Kozlowski --- drivers/base/platform.c | 63 ++++++++++++++++++++++++++++------------- include/linux/platform_device.h | 9 +++++- 2 files changed, 51 insertions(+), 21 deletions(-) diff --git a/drivers/base/platform.c b/drivers/base/platform.c index 0d3611cd1b3b..1458903a33c8 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -730,6 +730,45 @@ int __init_or_module __platform_driver_probe(struct platform_driver *drv, } EXPORT_SYMBOL_GPL(__platform_driver_probe); +/* + * platform_set_driver_override() - Helper to set or clear driver override. + * @pdev: platform device + * @override: Driver name to force a match, pass empty string to clear it + * + * Returns: 0 on success or a negative error code on failure. + */ +int platform_set_driver_override(struct platform_device *pdev, + const char *override) +{ + struct device *dev = &pdev->dev; + char *driver_override, *old, *cp; + + if (!pdev || !override) + return -EINVAL; + + driver_override = kstrndup(override, strlen(override), GFP_KERNEL); + if (!driver_override) + return -ENOMEM; + + cp = strchr(driver_override, '\n'); + if (cp) + *cp = '\0'; + + device_lock(dev); + old = pdev->driver_override; + if (strlen(driver_override)) { + pdev->driver_override = driver_override; + } else { + kfree(driver_override); + pdev->driver_override = NULL; + } + device_unlock(dev); + + kfree(old); + + return 0; +} + /** * __platform_create_bundle - register driver and create corresponding device * @driver: platform driver structure @@ -879,31 +918,15 @@ static ssize_t driver_override_store(struct device *dev, const char *buf, size_t count) { struct platform_device *pdev = to_platform_device(dev); - char *driver_override, *old, *cp; + int ret; /* We need to keep extra room for a newline */ if (count >= (PAGE_SIZE - 1)) return -EINVAL; - driver_override = kstrndup(buf, count, GFP_KERNEL); - if (!driver_override) - return -ENOMEM; - - cp = strchr(driver_override, '\n'); - if (cp) - *cp = '\0'; - - device_lock(dev); - old = pdev->driver_override; - if (strlen(driver_override)) { - pdev->driver_override = driver_override; - } else { - kfree(driver_override); - pdev->driver_override = NULL; - } - device_unlock(dev); - - kfree(old); + ret = platform_set_driver_override(pdev, buf); + if (ret) + return ret; return count; } diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h index c7c081dc6034..1dd06fed3306 100644 --- a/include/linux/platform_device.h +++ b/include/linux/platform_device.h @@ -29,7 +29,11 @@ struct platform_device { struct resource *resource; const struct platform_device_id *id_entry; - char *driver_override; /* Driver name to force a match */ + /* + * Driver name to force a match, use + * platform_set_driver_override() to set or clear it. + */ + char *driver_override; /* MFD cell pointer */ struct mfd_cell *mfd_cell; @@ -220,6 +224,9 @@ static inline void platform_set_drvdata(struct platform_device *pdev, dev_set_drvdata(&pdev->dev, data); } +int platform_set_driver_override(struct platform_device *pdev, + const char *override); + /* module_platform_driver() - Helper macro for drivers that don't do * anything special in module init/exit. This eliminates a lot of * boilerplate. Each module may only use this macro once, and From patchwork Mon Feb 18 10:15:59 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krzysztof Kozlowski X-Patchwork-Id: 10817697 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 40A0A1399 for ; Mon, 18 Feb 2019 10:17:14 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 305CC2A376 for ; Mon, 18 Feb 2019 10:17:14 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 242012A380; Mon, 18 Feb 2019 10:17:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D14D72A376 for ; Mon, 18 Feb 2019 10:17:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730058AbfBRKRC (ORCPT ); Mon, 18 Feb 2019 05:17:02 -0500 Received: from mail.kernel.org ([198.145.29.99]:60990 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730054AbfBRKRB (ORCPT ); Mon, 18 Feb 2019 05:17:01 -0500 Received: from PC-kkoz.proceq.com (unknown [213.160.61.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EAB2B2176F; Mon, 18 Feb 2019 10:16:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1550485020; bh=tDSa3P+fSylKnMCiEXnNmh9Gh3DjztB0EGX/Y8Y+AXw=; h=From:To:Subject:Date:In-Reply-To:References:From; b=t/QI9NgYeHrNe80RfWP9E0h5AWb8+WLJO7QiI9n5bLbzCCn9lHyTt0vxcMJ0xTG4r y3cOUlGSTCHjU/BTn0sEkxxtGEVLlBhlpe/SjGkrPMxc/nADDjrxe/QU1foI5YtKfN 0n+lTuh2sL/pLVHHzyWG9o8N/uNgPkU1NXwpDSdU= From: Krzysztof Kozlowski To: Russell King , Mark Brown , linux-kernel@vger.kernel.org, linux-spi@vger.kernel.org, Greg Kroah-Hartman , "Rafael J. Wysocki" , Sylwester Nawrocki , Tomasz Figa , Chanwoo Choi , Michael Turquette , Stephen Boyd , Kukjin Kim , Krzysztof Kozlowski , Andy Gross , David Brown , Srinivas Kandagatla , linux-samsung-soc@vger.kernel.org, linux-clk@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-arm-msm@vger.kernel.org, alsa-devel@alsa-project.org Subject: [RFC 3/4] clk: samsung: exynos5: Fix kfree() of const memory on setting driver_override Date: Mon, 18 Feb 2019 11:15:59 +0100 Message-Id: <1550484960-2392-4-git-send-email-krzk@kernel.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1550484960-2392-1-git-send-email-krzk@kernel.org> References: <1550484960-2392-1-git-send-email-krzk@kernel.org> Sender: linux-arm-msm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Platform driver driver_override field should not be initialized from const memory because the core later kfree() it. If driver_override is manually set later through sysfs, kfree() of old value leads to: $ echo "new_value" > /sys/bus/platform/drivers/.../driver_override kernel BUG at ../mm/slub.c:3960! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM ... (kfree) from [] (platform_set_driver_override+0x84/0xac) (platform_set_driver_override) from [] (driver_override_store+0x20/0x34) (driver_override_store) from [] (kernfs_fop_write+0x100/0x1dc) (kernfs_fop_write) from [] (__vfs_write+0x2c/0x17c) (__vfs_write) from [] (vfs_write+0xa4/0x188) (vfs_write) from [] (ksys_write+0x4c/0xac) (ksys_write) from [] (ret_fast_syscall+0x0/0x28) Signed-off-by: Krzysztof Kozlowski --- drivers/clk/samsung/clk-exynos5-subcmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/clk/samsung/clk-exynos5-subcmu.c b/drivers/clk/samsung/clk-exynos5-subcmu.c index d07ef26bd052..880d92ad20e8 100644 --- a/drivers/clk/samsung/clk-exynos5-subcmu.c +++ b/drivers/clk/samsung/clk-exynos5-subcmu.c @@ -143,7 +143,7 @@ static int __init exynos5_clk_register_subcmu(struct device *parent, return -ENOMEM; pdev->dev.parent = parent; - pdev->driver_override = "exynos5-subcmu"; + platform_set_driver_override(pdev, "exynos5-subcmu"); platform_set_drvdata(pdev, (void *)info); of_genpd_add_device(&genpdspec, &pdev->dev); ret = platform_device_add(pdev); From patchwork Mon Feb 18 10:16:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Krzysztof Kozlowski X-Patchwork-Id: 10817685 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0CC9317FB for ; Mon, 18 Feb 2019 10:17:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EE9452A376 for ; Mon, 18 Feb 2019 10:17:07 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E25D42A380; Mon, 18 Feb 2019 10:17:07 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 945D72A378 for ; Mon, 18 Feb 2019 10:17:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729981AbfBRKRG (ORCPT ); Mon, 18 Feb 2019 05:17:06 -0500 Received: from mail.kernel.org ([198.145.29.99]:32854 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729956AbfBRKRE (ORCPT ); Mon, 18 Feb 2019 05:17:04 -0500 Received: from PC-kkoz.proceq.com (unknown [213.160.61.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A7A3421848; Mon, 18 Feb 2019 10:17:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1550485024; bh=gNf/5Uk/N77EbTBib61uKhWZvxLozaD5/JezwNFwHzw=; h=From:To:Subject:Date:In-Reply-To:References:From; b=vAsukM95NUgr4qNKVk5IRNPMc2r5dElrspwsCt8JStKBTfiYNP5AERGeI9p5RtiUF LYAcQEOMzfWkf4CX30NXtxkz314WbP7KT8GfziSgzDJICueG5P0YRpxkOBrsYvI0VG RUX8kQuIyNfWmaFiSxDaCUEs2v8BaYM1apg82I6I= From: Krzysztof Kozlowski To: Russell King , Mark Brown , linux-kernel@vger.kernel.org, linux-spi@vger.kernel.org, Greg Kroah-Hartman , "Rafael J. Wysocki" , Sylwester Nawrocki , Tomasz Figa , Chanwoo Choi , Michael Turquette , Stephen Boyd , Kukjin Kim , Krzysztof Kozlowski , Andy Gross , David Brown , Srinivas Kandagatla , linux-samsung-soc@vger.kernel.org, linux-clk@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-arm-msm@vger.kernel.org, alsa-devel@alsa-project.org Subject: [RFC 4/4] slimbus: ngd: Fix kfree() of const memory on setting driver_override Date: Mon, 18 Feb 2019 11:16:00 +0100 Message-Id: <1550484960-2392-5-git-send-email-krzk@kernel.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1550484960-2392-1-git-send-email-krzk@kernel.org> References: <1550484960-2392-1-git-send-email-krzk@kernel.org> Sender: linux-arm-msm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Platform driver driver_override field should not be initialized from const memory because the core later kfree() it. If driver_override is manually set later through sysfs, kfree() of old value leads to: $ echo "new_value" > /sys/bus/platform/drivers/.../driver_override kernel BUG at ../mm/slub.c:3960! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM ... (kfree) from [] (platform_set_driver_override+0x84/0xac) (platform_set_driver_override) from [] (driver_override_store+0x20/0x34) (driver_override_store) from [] (kernfs_fop_write+0x100/0x1dc) (kernfs_fop_write) from [] (__vfs_write+0x2c/0x17c) (__vfs_write) from [] (vfs_write+0xa4/0x188) (vfs_write) from [] (ksys_write+0x4c/0xac) (ksys_write) from [] (ret_fast_syscall+0x0/0x28) Signed-off-by: Krzysztof Kozlowski --- drivers/slimbus/qcom-ngd-ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c index 71f094c9ec68..fc46bf6ec903 100644 --- a/drivers/slimbus/qcom-ngd-ctrl.c +++ b/drivers/slimbus/qcom-ngd-ctrl.c @@ -1344,7 +1344,7 @@ static int of_qcom_slim_ngd_register(struct device *parent, ngd->pdev = platform_device_alloc(QCOM_SLIM_NGD_DRV_NAME, id); ngd->id = id; ngd->pdev->dev.parent = parent; - ngd->pdev->driver_override = QCOM_SLIM_NGD_DRV_NAME; + platform_set_driver_override(ngd->pdev, QCOM_SLIM_NGD_DRV_NAME); ngd->pdev->dev.of_node = node; ctrl->ngd = ngd; platform_set_drvdata(ngd->pdev, ctrl);