Re: [patch net-next] mlxsw: core: Use devm_kzalloc to allocate mlxsw_hwmon structure

[Jiri Pirko]

Mon, Dec 21, 2015 at 04:12:06PM CET, j...@resnulli.us wrote:
>From: Jiri Pirko 
>
>KASan reported use-after-free for the hwmon structure. So fix this by
>using devm_kzalloc and let the core take care about freeing the memory
>during device dettach.

We found one small change is needed to be added. Will send v2.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[patch net-next] mlxsw: core: Use devm_kzalloc to allocate mlxsw_hwmon structure

[Jiri Pirko]

From: Jiri Pirko 

KASan reported use-after-free for the hwmon structure. So fix this by
using devm_kzalloc and let the core take care about freeing the memory
during device dettach.

Reported-by: Ido Schimmel 
Fixes: 89309da39 ("mlxsw: core: Implement temperature hwmon interface")
Signed-off-by: Jiri Pirko 
---
 drivers/net/ethernet/mellanox/mlxsw/core.c   | 2 --
 drivers/net/ethernet/mellanox/mlxsw/core.h   | 4 
 drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c | 8 ++--
 3 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c 
b/drivers/net/ethernet/mellanox/mlxsw/core.c
index af8a48b..22379eb 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -855,7 +855,6 @@ int mlxsw_core_bus_device_register(const struct 
mlxsw_bus_info *mlxsw_bus_info,
 err_debugfs_init:
mlxsw_core->driver->fini(mlxsw_core->driver_priv);
 err_driver_init:
-   mlxsw_hwmon_fini(mlxsw_core->hwmon);
 err_hwmon_init:
mlxsw_emad_fini(mlxsw_core);
 err_emad_init:
@@ -878,7 +877,6 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core 
*mlxsw_core)
 
mlxsw_core_debugfs_fini(mlxsw_core);
mlxsw_core->driver->fini(mlxsw_core->driver_priv);
-   mlxsw_hwmon_fini(mlxsw_core->hwmon);
mlxsw_emad_fini(mlxsw_core);
mlxsw_core->bus->fini(mlxsw_core->bus_priv);
kfree(mlxsw_core->lag.mapping);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.h 
b/drivers/net/ethernet/mellanox/mlxsw/core.h
index 4833fb3..a017236 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.h
@@ -239,10 +239,6 @@ static inline int mlxsw_hwmon_init(struct mlxsw_core 
*mlxsw_core,
return 0;
 }
 
-static inline void mlxsw_hwmon_fini(struct mlxsw_hwmon *mlxsw_hwmon)
-{
-}
-
 #endif
 
 #endif
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c 
b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
index 00ccf1c..0aacbf7 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
@@ -334,7 +334,8 @@ int mlxsw_hwmon_init(struct mlxsw_core *mlxsw_core,
struct device *hwmon_dev;
int err;
 
-   mlxsw_hwmon = kzalloc(sizeof(*mlxsw_hwmon), GFP_KERNEL);
+   mlxsw_hwmon = devm_kzalloc(mlxsw_bus_info->dev, sizeof(*mlxsw_hwmon),
+  GFP_KERNEL);
if (!mlxsw_hwmon)
return -ENOMEM;
mlxsw_hwmon->core = mlxsw_core;
@@ -370,8 +371,3 @@ err_temp_init:
kfree(mlxsw_hwmon);
return err;
 }
-
-void mlxsw_hwmon_fini(struct mlxsw_hwmon *mlxsw_hwmon)
-{
-   kfree(mlxsw_hwmon);
-}
-- 
1.9.3

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html