* [PATCH] drivers: nvdimm: fix dereference after free
@ 2023-08-17 11:41 Konstantin Meskhidze
2023-08-17 14:31 ` Jeff Moyer
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Konstantin Meskhidze @ 2023-08-17 11:41 UTC (permalink / raw)
To: dan.j.williams
Cc: vishal.l.verma, dave.jiang, ira.weiny, nvdimm, linux-kernel,
yusongping, artem.kuzin
'nd_pmu->pmu.attr_groups' is dereferenced in function
'nvdimm_pmu_free_hotplug_memory' call after it has been freed. Because in
function 'nvdimm_pmu_free_hotplug_memory' memory pointed by the fields of
'nd_pmu->pmu.attr_groups' is deallocated it is necessary to call 'kfree'
after 'nvdimm_pmu_free_hotplug_memory'.
Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
---
drivers/nvdimm/nd_perf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvdimm/nd_perf.c b/drivers/nvdimm/nd_perf.c
index 14881c4e0..2b6dc80d8 100644
--- a/drivers/nvdimm/nd_perf.c
+++ b/drivers/nvdimm/nd_perf.c
@@ -307,10 +307,10 @@ int register_nvdimm_pmu(struct nvdimm_pmu *nd_pmu, struct platform_device *pdev)
}
rc = perf_pmu_register(&nd_pmu->pmu, nd_pmu->pmu.name, -1);
if (rc) {
- kfree(nd_pmu->pmu.attr_groups);
nvdimm_pmu_free_hotplug_memory(nd_pmu);
+ kfree(nd_pmu->pmu.attr_groups);
return rc;
}
pr_info("%s NVDIMM performance monitor support registered\n",
--
2.34.1
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] drivers: nvdimm: fix dereference after free
2023-08-17 11:41 [PATCH] drivers: nvdimm: fix dereference after free Konstantin Meskhidze
@ 2023-08-17 14:31 ` Jeff Moyer
2023-08-17 15:45 ` Dave Jiang
2023-08-17 15:51 ` Dan Williams
2 siblings, 0 replies; 5+ messages in thread
From: Jeff Moyer @ 2023-08-17 14:31 UTC (permalink / raw)
To: Konstantin Meskhidze
Cc: dan.j.williams, vishal.l.verma, dave.jiang, ira.weiny, nvdimm,
linux-kernel, yusongping, artem.kuzin
Konstantin Meskhidze <konstantin.meskhidze@huawei.com> writes:
> 'nd_pmu->pmu.attr_groups' is dereferenced in function
> 'nvdimm_pmu_free_hotplug_memory' call after it has been freed. Because in
> function 'nvdimm_pmu_free_hotplug_memory' memory pointed by the fields of
> 'nd_pmu->pmu.attr_groups' is deallocated it is necessary to call 'kfree'
> after 'nvdimm_pmu_free_hotplug_memory'.
>
> Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
> ---
> drivers/nvdimm/nd_perf.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/nvdimm/nd_perf.c b/drivers/nvdimm/nd_perf.c
> index 14881c4e0..2b6dc80d8 100644
> --- a/drivers/nvdimm/nd_perf.c
> +++ b/drivers/nvdimm/nd_perf.c
> @@ -307,10 +307,10 @@ int register_nvdimm_pmu(struct nvdimm_pmu *nd_pmu, struct platform_device *pdev)
> }
>
> rc = perf_pmu_register(&nd_pmu->pmu, nd_pmu->pmu.name, -1);
> if (rc) {
> - kfree(nd_pmu->pmu.attr_groups);
> nvdimm_pmu_free_hotplug_memory(nd_pmu);
> + kfree(nd_pmu->pmu.attr_groups);
> return rc;
> }
>
> pr_info("%s NVDIMM performance monitor support registered\n",
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] drivers: nvdimm: fix dereference after free
2023-08-17 11:41 [PATCH] drivers: nvdimm: fix dereference after free Konstantin Meskhidze
2023-08-17 14:31 ` Jeff Moyer
@ 2023-08-17 15:45 ` Dave Jiang
2023-08-17 16:04 ` Dave Jiang
2023-08-17 15:51 ` Dan Williams
2 siblings, 1 reply; 5+ messages in thread
From: Dave Jiang @ 2023-08-17 15:45 UTC (permalink / raw)
To: Konstantin Meskhidze, dan.j.williams
Cc: vishal.l.verma, ira.weiny, nvdimm, linux-kernel, yusongping, artem.kuzin
On 8/17/23 04:41, Konstantin Meskhidze wrote:
> 'nd_pmu->pmu.attr_groups' is dereferenced in function
> 'nvdimm_pmu_free_hotplug_memory' call after it has been freed. Because in
> function 'nvdimm_pmu_free_hotplug_memory' memory pointed by the fields of
> 'nd_pmu->pmu.attr_groups' is deallocated it is necessary to call 'kfree'
> after 'nvdimm_pmu_free_hotplug_memory'.
>
> Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
LGTM
Does this need a Fixes tag?
> ---
> drivers/nvdimm/nd_perf.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/nvdimm/nd_perf.c b/drivers/nvdimm/nd_perf.c
> index 14881c4e0..2b6dc80d8 100644
> --- a/drivers/nvdimm/nd_perf.c
> +++ b/drivers/nvdimm/nd_perf.c
> @@ -307,10 +307,10 @@ int register_nvdimm_pmu(struct nvdimm_pmu *nd_pmu, struct platform_device *pdev)
> }
>
> rc = perf_pmu_register(&nd_pmu->pmu, nd_pmu->pmu.name, -1);
> if (rc) {
> - kfree(nd_pmu->pmu.attr_groups);
> nvdimm_pmu_free_hotplug_memory(nd_pmu);
> + kfree(nd_pmu->pmu.attr_groups);
> return rc;
> }
>
> pr_info("%s NVDIMM performance monitor support registered\n",
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] drivers: nvdimm: fix dereference after free
2023-08-17 15:45 ` Dave Jiang
@ 2023-08-17 16:04 ` Dave Jiang
0 siblings, 0 replies; 5+ messages in thread
From: Dave Jiang @ 2023-08-17 16:04 UTC (permalink / raw)
To: Konstantin Meskhidze, dan.j.williams
Cc: vishal.l.verma, ira.weiny, nvdimm, linux-kernel, yusongping, artem.kuzin
On 8/17/23 08:45, Dave Jiang wrote:
>
>
> On 8/17/23 04:41, Konstantin Meskhidze wrote:
>> 'nd_pmu->pmu.attr_groups' is dereferenced in function
>> 'nvdimm_pmu_free_hotplug_memory' call after it has been freed. Because in
>> function 'nvdimm_pmu_free_hotplug_memory' memory pointed by the fields of
>> 'nd_pmu->pmu.attr_groups' is deallocated it is necessary to call 'kfree'
>> after 'nvdimm_pmu_free_hotplug_memory'.
>>
>> Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
>> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
>
> LGTM
>
> Does this need a Fixes tag?
Applied. Modified subject to "nvdimm: Fix dereference after free in
register_nvdimm_pmu()"
Also added Fixes tag:
Fixes: 0fab1ba6ad6b ("drivers/nvdimm: Add perf interface to expose
nvdimm performance stats")
>
>> ---
>> drivers/nvdimm/nd_perf.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/nvdimm/nd_perf.c b/drivers/nvdimm/nd_perf.c
>> index 14881c4e0..2b6dc80d8 100644
>> --- a/drivers/nvdimm/nd_perf.c
>> +++ b/drivers/nvdimm/nd_perf.c
>> @@ -307,10 +307,10 @@ int register_nvdimm_pmu(struct nvdimm_pmu
>> *nd_pmu, struct platform_device *pdev)
>> }
>> rc = perf_pmu_register(&nd_pmu->pmu, nd_pmu->pmu.name, -1);
>> if (rc) {
>> - kfree(nd_pmu->pmu.attr_groups);
>> nvdimm_pmu_free_hotplug_memory(nd_pmu);
>> + kfree(nd_pmu->pmu.attr_groups);
>> return rc;
>> }
>> pr_info("%s NVDIMM performance monitor support registered\n",
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: [PATCH] drivers: nvdimm: fix dereference after free
2023-08-17 11:41 [PATCH] drivers: nvdimm: fix dereference after free Konstantin Meskhidze
2023-08-17 14:31 ` Jeff Moyer
2023-08-17 15:45 ` Dave Jiang
@ 2023-08-17 15:51 ` Dan Williams
2 siblings, 0 replies; 5+ messages in thread
From: Dan Williams @ 2023-08-17 15:51 UTC (permalink / raw)
To: Konstantin Meskhidze, dan.j.williams
Cc: vishal.l.verma, dave.jiang, ira.weiny, nvdimm, linux-kernel,
yusongping, artem.kuzin, kjain
[ add Kajol ]
Konstantin Meskhidze wrote:
> 'nd_pmu->pmu.attr_groups' is dereferenced in function
> 'nvdimm_pmu_free_hotplug_memory' call after it has been freed. Because in
> function 'nvdimm_pmu_free_hotplug_memory' memory pointed by the fields of
> 'nd_pmu->pmu.attr_groups' is deallocated it is necessary to call 'kfree'
> after 'nvdimm_pmu_free_hotplug_memory'.
Another one that would be fixed by static attribute groups.
I do think we should move forward with these fixes as is for ease of backport,
but long term this dynamically allocated attribute groups approach needs to be
jettisoned. ...unless I am missing a concrete reason it needs to remain dynamic?
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-08-17 16:09 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-17 11:41 [PATCH] drivers: nvdimm: fix dereference after free Konstantin Meskhidze
2023-08-17 14:31 ` Jeff Moyer
2023-08-17 15:45 ` Dave Jiang
2023-08-17 16:04 ` Dave Jiang
2023-08-17 15:51 ` Dan Williams
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®