[v1] misc: microchip: pci1xxxx: Fix possible double free in error handling path

[PATCH] misc: microchip: pci1xxxx: Fix possible double free in error handling path

Posted by Ma Ke 1 year, 1 month ago

When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), the callback function
gp_auxiliary_device_release() calls kfree() to free memory. Do not
call kfree() again in the error handling path.

Fix this by skipping the redundant kfree().

Found by code review.

Cc: stable@vger.kernel.org
Fixes: 393fc2f5948f ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
 drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
index 32af2b14ff34..fbd712938bdc 100644
--- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
+++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
@@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
 
 err_aux_dev_add_1:
 	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);
+	goto err_aux_dev_add_0;
 
 err_aux_dev_init_1:
 	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id);
@@ -120,6 +121,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
 
 err_aux_dev_add_0:
 	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);
+	goto err_ret;
 
 err_aux_dev_init_0:
 	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);
-- 
2.25.1

Re: [PATCH] misc: microchip: pci1xxxx: Fix possible double free in error handling path

Posted by Christophe JAILLET 1 year, 1 month ago

Le 06/01/2025 à 08:40, Ma Ke a écrit :
> When auxiliary_device_add() returns error and then calls
> auxiliary_device_uninit(), the callback function
> gp_auxiliary_device_release() calls kfree() to free memory. Do not
> call kfree() again in the error handling path.
> 
> Fix this by skipping the redundant kfree().
> 
> Found by code review.
> 
> Cc: stable@vger.kernel.org
> Fixes: 393fc2f5948f ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.")
> Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> ---
>   drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
> index 32af2b14ff34..fbd712938bdc 100644
> --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
> +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
> @@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
>   
>   err_aux_dev_add_1:
>   	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);
> +	goto err_aux_dev_add_0;
>   
>   err_aux_dev_init_1:
>   	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id);
> @@ -120,6 +121,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
>   
>   err_aux_dev_add_0:
>   	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);
> +	goto err_ret;
>   
>   err_aux_dev_init_0:
>   	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);

Hi,

This is strange because the nearly same patch is in -next since June 
2024 ([1])

It is also in Linux since at least 6.10 ([2])

In [1] and [2], there is also a new err_ret label, which is not part of 
your patch.

On which tree are you working?
Is your patch compile tested?

CJ


[1]: 
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c?id=086c6cbcc563c81d55257f9b27e14faf1d0963d3

[2]: 
https://elixir.bootlin.com/linux/v6.10/source/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c#L116

Re: [PATCH] misc: microchip: pci1xxxx: Fix possible double free in error handling path

Posted by Ma Ke 1 year, 1 month ago

Christophe JAILLET<christophe.jaillet@wanadoo.fr> wrote:
> Ma Ke <make24@iscas.ac.cn> writes:
> > When auxiliary_device_add() returns error and then calls
> > auxiliary_device_uninit(), the callback function
> > gp_auxiliary_device_release() calls kfree() to free memory. Do not
> > call kfree() again in the error handling path.
> > 
> > Fix this by skipping the redundant kfree().
> > 
> > Found by code review.
> > 
> > Cc: stable@vger.kernel.org
> > Fixes: 393fc2f5948f ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.")
> > Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> > ---
> >   drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c | 2 ++
> >   1 file changed, 2 insertions(+)
> > 
> > diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
> > index 32af2b14ff34..fbd712938bdc 100644
> > --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
> > +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
> > @@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
> >   
> >   err_aux_dev_add_1:
> >   	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);
> > +	goto err_aux_dev_add_0;
> >   
> >   err_aux_dev_init_1:
> >   	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id);
> > @@ -120,6 +121,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
> >   
> >   err_aux_dev_add_0:
> >   	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);
> > +	goto err_ret;
> >   
> >   err_aux_dev_init_0:
> >   	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);
> 
> Hi,
> 
> This is strange because the nearly same patch is in -next since June 
> 2024 ([1])
> 
> It is also in Linux since at least 6.10 ([2])
> 
> In [1] and [2], there is also a new err_ret label, which is not part of 
> your patch.
> 
> On which tree are you working?
> Is your patch compile tested?
> 
> CJ

Thank you for your response. I discovered the aforementioned bug in 
Linux kernel v6.4.16 (the latest v6.4). It appears that the fix was 
not completed in the latest version of v6.4. I have also checked the 
link you mentioned and saw that the issue has been fixed in v6.10. I 
realize that I omitted the final jump patch in the patch v1 submitted,
and I will perfect it in patch v2. Thank you for your suggestion.
--
Regards,

Ma Ke

Re: [PATCH] misc: microchip: pci1xxxx: Fix possible double free in error handling path

Posted by Christophe JAILLET 1 year, 1 month ago

Le 07/01/2025 à 02:19, Ma Ke a écrit :
> Christophe JAILLET<christophe.jaillet@wanadoo.fr> wrote:
>> Ma Ke <make24@iscas.ac.cn> writes:
>>> When auxiliary_device_add() returns error and then calls
>>> auxiliary_device_uninit(), the callback function
>>> gp_auxiliary_device_release() calls kfree() to free memory. Do not
>>> call kfree() again in the error handling path.
>>>
>>> Fix this by skipping the redundant kfree().
>>>
>>> Found by code review.
>>>
>>> Cc: stable@vger.kernel.org
>>> Fixes: 393fc2f5948f ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.")
>>> Signed-off-by: Ma Ke <make24@iscas.ac.cn>
>>> ---
>>>    drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c | 2 ++
>>>    1 file changed, 2 insertions(+)
>>>
>>> diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
>>> index 32af2b14ff34..fbd712938bdc 100644
>>> --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
>>> +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
>>> @@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
>>>    
>>>    err_aux_dev_add_1:
>>>    	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);
>>> +	goto err_aux_dev_add_0;
>>>    
>>>    err_aux_dev_init_1:
>>>    	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id);
>>> @@ -120,6 +121,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
>>>    
>>>    err_aux_dev_add_0:
>>>    	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);
>>> +	goto err_ret;
>>>    
>>>    err_aux_dev_init_0:
>>>    	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);
>>
>> Hi,
>>
>> This is strange because the nearly same patch is in -next since June
>> 2024 ([1])
>>
>> It is also in Linux since at least 6.10 ([2])
>>
>> In [1] and [2], there is also a new err_ret label, which is not part of
>> your patch.
>>
>> On which tree are you working?
>> Is your patch compile tested?
>>
>> CJ
> 
> Thank you for your response. I discovered the aforementioned bug in
> Linux kernel v6.4.16 (the latest v6.4). It appears that the fix was
> not completed in the latest version of v6.4. I have also checked the
> link you mentioned and saw that the issue has been fixed in v6.10. I
> realize that I omitted the final jump patch in the patch v1 submitted,
> and I will perfect it in patch v2. Thank you for your suggestion.

v6.4 is not supported any more, so an updated patch would never be applied.
See active branches on https://www.kernel.org/.

Anyway, when don't working on a recent tree, you should tell it, because 
no one can guess that your patch is related to something old.

 > I realize that I omitted the final jump

So I guess, that you not compile tested your patch.
You should never do that, event when the change looks trivial.

CJ