Hi Dan, On Thu Jun 28 06:03, Dan Carpenter wrote: > [ We are working on a bug in the kbuild scripts but right now the > warnings aren't getting displayed so it's up to me to find a bug > Smatch *would* have complained about. - dan ] > > Hi Curt, > > Thank you for the patch! Perhaps something to improve: > > url: https://github.com/0day-ci/linux/commits/Curt-Brune/ACPI-properties-expose-device-properties-through-sysfs/20180628-023020 > base: https://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git linux-next > > # https://github.com/0day-ci/linux/commit/ac7a4f1b39af207f1fc7630f13d9e04314efae60 > git remote add linux-review https://github.com/0day-ci/linux > git remote update linux-review > git checkout ac7a4f1b39af207f1fc7630f13d9e04314efae60 > vim +/sysfs_name +822 drivers/acpi/device_sysfs.c > > ac7a4f1b Curt Brune 2018-06-27 789 > ac7a4f1b Curt Brune 2018-06-27 790 static void acpi_property_remove_attr(struct acpi_device *adev, > ac7a4f1b Curt Brune 2018-06-27 791 const char *property) > ac7a4f1b Curt Brune 2018-06-27 792 { > ac7a4f1b Curt Brune 2018-06-27 793 struct attribute attr = { 0 }; > ac7a4f1b Curt Brune 2018-06-27 794 const union acpi_object *obj; > ac7a4f1b Curt Brune 2018-06-27 795 struct acpi_reference_args args; > ac7a4f1b Curt Brune 2018-06-27 796 char *sysfs_name; > ac7a4f1b Curt Brune 2018-06-27 797 int idx; > ac7a4f1b Curt Brune 2018-06-27 798 int err; > ac7a4f1b Curt Brune 2018-06-27 799 > ac7a4f1b Curt Brune 2018-06-27 800 err = acpi_dev_get_property(adev, property, ACPI_TYPE_ANY, &obj); > ac7a4f1b Curt Brune 2018-06-27 801 if (err) > ac7a4f1b Curt Brune 2018-06-27 802 return; > ac7a4f1b Curt Brune 2018-06-27 803 > ac7a4f1b Curt Brune 2018-06-27 804 attr.name = property; > ac7a4f1b Curt Brune 2018-06-27 805 sysfs_remove_file(&adev->data.kobj, &attr); > ac7a4f1b Curt Brune 2018-06-27 806 > ac7a4f1b Curt Brune 2018-06-27 807 idx = 0; > ac7a4f1b Curt Brune 2018-06-27 808 while (__acpi_dev_get_property_reference(adev, property, idx, > ac7a4f1b Curt Brune 2018-06-27 809 &args) == 0) { > ac7a4f1b Curt Brune 2018-06-27 810 if (idx == 0) > ac7a4f1b Curt Brune 2018-06-27 811 sysfs_name = kasprintf(GFP_KERNEL, "%s", property); > ac7a4f1b Curt Brune 2018-06-27 812 else > ac7a4f1b Curt Brune 2018-06-27 813 sysfs_name = kasprintf(GFP_KERNEL, "%s%u", property, > ac7a4f1b Curt Brune 2018-06-27 814 idx); > ac7a4f1b Curt Brune 2018-06-27 815 if (!sysfs_name) > ac7a4f1b Curt Brune 2018-06-27 816 continue; > ac7a4f1b Curt Brune 2018-06-27 817 > ac7a4f1b Curt Brune 2018-06-27 818 sysfs_remove_link(&adev->data.kobj, sysfs_name); > ac7a4f1b Curt Brune 2018-06-27 819 kfree(sysfs_name); > ^^^^^^^^^^ > ac7a4f1b Curt Brune 2018-06-27 820 > ac7a4f1b Curt Brune 2018-06-27 821 if (args.nargs > 0) { > ac7a4f1b Curt Brune 2018-06-27 @822 attr.name = kasprintf(GFP_KERNEL, "%s_args", > ac7a4f1b Curt Brune 2018-06-27 823 sysfs_name); > ^^^^^^^^^^ > Use after free. > This is a great find. Thanks for the catch! I will fix that. Cheers, Curt -- To unsubscribe from this list: send the line "unsubscribe linux-acpi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
