Re: [PATCH] spi: Avoid calling spi_slave_abort() with kfreed spidev

[Lukasz Majewski <lukma@denx.de>]

[-- Attachment #1: Type: text/plain, Size: 2555 bytes --]

Hi Geert,

Thank you for a very prompt response.

> Hi Lukasz,
> 
> On Tue, Oct 1, 2019 at 11:07 AM Lukasz Majewski <lukma@denx.de> wrote:
> > Call spi_slave_abort() only when the spidev->spi is !NULL and the
> > structure hasn't already been kfreed.
> >
> > Reported-by: kbuild test robot <lkp@intel.com>
> > Reported-by: Julia Lawall <julia.lawall@lip6.fr>
> > Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> > Signed-off-by: Lukasz Majewski <lukma@denx.de>  
> 
> Thanks for your patch!
> 
> > --- a/drivers/spi/spidev.c
> > +++ b/drivers/spi/spidev.c
> > @@ -600,15 +600,16 @@ static int spidev_open(struct inode *inode,
> > struct file *filp) static int spidev_release(struct inode *inode,
> > struct file *filp) {
> >         struct spidev_data      *spidev;
> > +       int dofree;  
> 
> bool?

It may be bool, yes - I took this "int" from the original code (further
down in the patch), as I've moved it a bit up.

> 
> >
> >         mutex_lock(&device_list_lock);
> >         spidev = filp->private_data;
> >         filp->private_data = NULL;
> > +       dofree = 0;  
> 
> Why not initialize it at declaration time?

I wanted to have it protected by mutex_lock() above. However, this also
shall work with the initialization at declaration time.

> 
> >
> >         /* last close? */
> >         spidev->users--;
> >         if (!spidev->users) {
> > -               int             dofree;
> >
> >                 kfree(spidev->tx_buffer);
> >                 spidev->tx_buffer = NULL;
> > @@ -628,7 +629,8 @@ static int spidev_release(struct inode *inode,
> > struct file *filp) kfree(spidev);
> >         }
> >  #ifdef CONFIG_SPI_SLAVE
> > -       spi_slave_abort(spidev->spi);
> > +       if (!dofree)
> > +               spi_slave_abort(spidev->spi);  
> 
> Can spidev->spi be NULL, if spidev->users != 0?

No, it shouldn't be.

The "dofree" is only set to true (the spidev->spi == NULL condition is
checked) if there are no references (spidev->users == 0).

The if (!dofree) prevents from calling spi_slave_abort() when
spidev->spi == NULL and spidev is kfree'd.

> 
> >  #endif
> >         mutex_unlock(&device_list_lock);  
> 
> Gr{oetje,eeting}s,
> 
>                         Geert
> 




Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: lukma@denx.de

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]