Re: [PATCH] regmap: Fix possible double-free in regcache_rbtree_exit()

[Yang Yingliang <yangyingliang@huawei.com>]

Hi,

On 2021/10/12 1:40, Mark Brown wrote:
> On Mon, Oct 11, 2021 at 09:55:26PM +0800, Yang Yingliang wrote:
>> In regcache_rbtree_insert_to_block(), when 'present' realloc failed,
>> the 'blk' which is supposed to assign to 'rbnode->block' will be freed,
>> so 'rbnode->block' points a freed memory, in the error handling path of
>> regcache_rbtree_init(), 'rbnode->block' will be freed again in
>> regcache_rbtree_exit(), KASAN will report double-free as follows:
>>
>> BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
>> Call Trace:
>>   dump_stack_lvl+0xe2/0x152
>>   print_address_description.constprop.7+0x21/0x150
>>   kasan_report_invalid_free+0x6f/0xa0
>>   __kasan_slab_free+0x125/0x140
> Please think hard before including complete backtraces in upstream
> reports, they are very large and contain almost no useful information
> relative to their size so often obscure the relevant content in your
> message. If part of the backtrace is usefully illustrative (it often is
> for search engines if nothing else) then it's usually better to pull out
> the relevant sections.
OK
>
>> Set rbnode->block to NULL when the 'present' realloc failed to fix this.
> This is not a good fix, it will both leak block and corrupt the data
> structure since now there's a NULL pointer where there should be a data
> block.  We should instead be moving the assignment of rbnode->block up
> to immediately after the reallocation has succeeded so that the data
> structure stays valid even if the second reallocation fails.
I will send a v2 later.

Thanks,
Yang