Re: [PATCH v2 1/2] EDAC/device_sysfs: Fix calling kobject_put() with ->state_initialized unset

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 25/01/24 6:39 pm, Borislav Petkov wrote:
On Tue, Nov 28, 2023 at 10:30:35AM -0800, Harshit Mogalapalli wrote:
In edac_device_register_sysfs_main_kobj(), when dev_root is NULL,

Thanks for checking this.

When is dev_root NULL?

A real use case or this is just from code staring?

This is based on static analysis, not real testing.

diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
index 010c26be5846..4cac14cbdb60 100644
--- a/drivers/edac/edac_device_sysfs.c
+++ b/drivers/edac/edac_device_sysfs.c
@@ -253,11 +253,13 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
/* register */
  	dev_root = bus_get_dev_root(edac_subsys);
-	if (dev_root) {
-		err = kobject_init_and_add(&edac_dev->kobj, &ktype_device_ctrl,
-					   &dev_root->kobj, "%s", edac_dev->name);

What cb4a0bec0bb9 did looks wrong. That if (err) check should be inside
the if (dev_root).

IOW, that function's error checking needs balancing. Something like
this below.

And looking at the other one, it has the same issue...

---
diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
index 237a542e045a..3476ef13e681 100644
--- a/drivers/edac/edac_device_sysfs.c
+++ b/drivers/edac/edac_device_sysfs.c
@@ -228,8 +228,8 @@ static struct kobj_type ktype_device_ctrl = {
   */
  int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
  {
-	struct device *dev_root;
  	const struct bus_type *edac_subsys;
+	struct device *dev_root;
  	int err = -ENODEV;
edac_dbg(1, "\n");
@@ -243,26 +243,26 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
  	/* Init the devices's kobject */
  	memset(&edac_dev->kobj, 0, sizeof(struct kobject));
- /* Record which module 'owns' this control structure
-	 * and bump the ref count of the module
+	/*
+	 * Record which module 'owns' this control structure and bump
+	 * the ref count of the module
  	 */
  	edac_dev->owner = THIS_MODULE;
if (!try_module_get(edac_dev->owner))
  		goto err_out;
- /* register */
  	dev_root = bus_get_dev_root(edac_subsys);
-	if (dev_root) {
-		err = kobject_init_and_add(&edac_dev->kobj, &ktype_device_ctrl,
-					   &dev_root->kobj, "%s", edac_dev->name);
-		put_device(dev_root);
-	}
+	if (!dev_root)
+		goto err_module;
+
+	err = kobject_init_and_add(&edac_dev->kobj, &ktype_device_ctrl,
+				   &dev_root->kobj, "%s", edac_dev->name);
  	if (err) {
-		edac_dbg(1, "Failed to register '.../edac/%s'\n",
-			 edac_dev->name);
+		edac_dbg(1, "Failed to register '.../edac/%s'\n", edac_dev->name);
  		goto err_kobj_reg;
  	}
+
  	kobject_uevent(&edac_dev->kobj, KOBJ_ADD);
/* At this point, to 'free' the control struct,
@@ -273,9 +273,11 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
return 0; - /* Error exit stack */
  err_kobj_reg:
  	kobject_put(&edac_dev->kobj);
+	put_device(dev_root);

In this diff, put_device(dev_root) is not called on the success path. I checked couple of other callers of bus_get_dev_root() and they call put_device(dev_root) after using dev_root. I think we need to have put_device() on the success path as well.

+
+err_module:
  	module_put(edac_dev->owner);


An alternate diff could be:

diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
index 237a542e045a..0c8e66e40af8 100644
--- a/drivers/edac/edac_device_sysfs.c
+++ b/drivers/edac/edac_device_sysfs.c
@@ -275,7 +275,8 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)

        /* Error exit stack */
 err_kobj_reg:
-       kobject_put(&edac_dev->kobj);
+       if(dev_root)
+               kobject_put(&edac_dev->kobj);
        module_put(edac_dev->owner);

 err_out:

Thanks,
Harshit


  err_out:






[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux