On Wed, 13 Oct 2021 08:51:38 +0300
Andy Shevchenko <andy.shevchenko@xxxxxxxxx> wrote:
> On Wednesday, October 13, 2021, Andy Shevchenko <andy.shevchenko@xxxxxxxxx>
> wrote:
>
> >
> >
> > On Wednesday, October 13, 2021, Yang Yingliang <yangyingliang@xxxxxxxxxx>
> > wrote:
> >
> >> I got the double free report:
> >>
> >> BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
> >
> >
> >
> >> kfree+0xce/0x390
> >
> >
> >
> > This line also redundant, but no need to resend, I hope Jonathan can do it
> > for you.
> >
> >
> >> iio_device_unregister_sysfs+0x108/0x13b [industrialio]
> >> iio_dev_release+0x9e/0x10e [
> >
> >
> >>
>
>
> >
> >> device_release+0xa5/0x240
> >> kobject_put+0x1e5/0x540
> >> put_device+0x20/0x30
> >> devm_iio_device_release+0x21/0x30 [industrialio]
> >
> >
> >>
> Actually above lines are also part of the noise
Not sure I'm quite so keen to strip everything back completely (though I do
agree keeping it fairly minimal is good.
Anyhow, tidied it up a bit and applied. I also added a note that more
radical surgery is needed to clean up the lifetime management but in the
meantime this deals with the symptoms.
Applied to the fixes-togreg branch of iio.git and marked for stable.
Thanks,
Jonathan
>
>
> >
> >> If __iio_device_register() fails, iio_dev_opaque->groups will be freed
> >> in error path in iio_device_unregister_sysfs(), then iio_dev_release()
> >> will call iio_device_unregister_sysfs() again, it causes double free.
> >> Set iio_dev_opaque->groups to NULL when it's freed to fix this double
> >> free.
> >>
> >> Fixes: 32f171724e5c ("iio: core: rework iio device group creation")
> >> Reported-by: Hulk Robot <hulkci@xxxxxxxxxx>
> >> Reviewed-by: Alexandru Ardelean <ardeleanalex@xxxxxxxxx>
> >> Signed-off-by: Yang Yingliang <yangyingliang@xxxxxxxxxx>
> >> ---
> >> v1 -> v3:
> >> reduce some backtrace in commit message
> >> ---
> >> drivers/iio/industrialio-core.c | 1 +
> >> 1 file changed, 1 insertion(+)
> >>
> >> diff --git a/drivers/iio/industrialio-core.c
> >> b/drivers/iio/industrialio-core.c
> >> index 2dbb37e09b8c..2dc837db50f7 100644
> >> --- a/drivers/iio/industrialio-core.c
> >> +++ b/drivers/iio/industrialio-core.c
> >> @@ -1600,6 +1600,7 @@ static void iio_device_unregister_sysfs(struct
> >> iio_dev *indio_dev)
> >> kfree(iio_dev_opaque->chan_attr_group.attrs);
> >> iio_dev_opaque->chan_attr_group.attrs = NULL;
> >> kfree(iio_dev_opaque->groups);
> >> + iio_dev_opaque->groups = NULL;
> >> }
> >>
> >> static void iio_dev_release(struct device *device)
> >> --
> >> 2.25.1
> >
> >
>
>
>
>
>
>
>
>
> >
> >>
> >>
> >
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> >
> >
> > --
> > With Best Regards,
> > Andy Shevchenko
> >
> >
> >
>
