[v5] gpio: sim: fix an invalid __free() usage
Commit Message
From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
gpio_sim_make_line_names() returns NULL or ERR_PTR() so we must not use
__free(kfree) on the returned address. Split this function into two, one
that determines the size of the "gpio-line-names" array to allocate and
one that actually sets the names at correct offsets. The allocation and
assignment of the managed pointer happens in between.
Fixes: 3faf89f27aab ("gpio: sim: simplify code with cleanup helpers")
Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
Closes: https://lore.kernel.org/all/07c32bf1-6c1a-49d9-b97d-f0ae4a2b42ab@p183/
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
---
Hopefully this is the last version of this patch. I restored the max()
assignment from v3 but kept the code simpler than v2. Tested most corner
cases that occurred to me.
v4 -> v5:
- restore checking for the higher offset in each iteration when counting
named lines
v3 -> v4:
- simplify the line counting logic
v2 -> v3:
- restore the offset out-of-bounds checks
v1 -> v2:
- split the line name setting into two parts
drivers/gpio/gpio-sim.c | 60 ++++++++++++++++-------------------------
1 file changed, 23 insertions(+), 37 deletions(-)
Comments
On Wed, Sep 20, 2023 at 09:32:53AM +0200, Bartosz Golaszewski wrote:
> From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
>
> gpio_sim_make_line_names() returns NULL or ERR_PTR() so we must not use
> __free(kfree) on the returned address. Split this function into two, one
> that determines the size of the "gpio-line-names" array to allocate and
> one that actually sets the names at correct offsets. The allocation and
> assignment of the managed pointer happens in between.
...
> list_for_each_entry(line, &bank->line_list, siblings) {
> - if (line->offset >= bank->num_lines)
> + if (!line->name || (line->offset >= bank->num_lines))
> continue;
>
> - if (line->name) {
> - if (line->offset > max_offset)
> - max_offset = line->offset;
> -
> - /*
> - * max_offset can stay at 0 so it's not an indicator
> - * of whether line names were configured at all.
> - */
> - has_line_names = true;
> - }
> + size = max(size, line->offset + 1);
> }
As for the material to be backported it's fine, but I'm wondering if we
actually can add the entries in a sorted manner, so we would need the exact
what I mentioned in previous review round, just search backwards to the first
satisfying entry. I don't believe the adding an entry to the list is a
hot-path, so would be fine to call list_sort().
On Wed, 20 Sep 2023 15:43:47 +0200, Andy Shevchenko
<andriy.shevchenko@linux.intel.com> said:
> On Wed, Sep 20, 2023 at 09:32:53AM +0200, Bartosz Golaszewski wrote:
>> From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
>>
>> gpio_sim_make_line_names() returns NULL or ERR_PTR() so we must not use
>> __free(kfree) on the returned address. Split this function into two, one
>> that determines the size of the "gpio-line-names" array to allocate and
>> one that actually sets the names at correct offsets. The allocation and
>> assignment of the managed pointer happens in between.
>
> ...
>
>> list_for_each_entry(line, &bank->line_list, siblings) {
>> - if (line->offset >= bank->num_lines)
>> + if (!line->name || (line->offset >= bank->num_lines))
>> continue;
>>
>> - if (line->name) {
>> - if (line->offset > max_offset)
>> - max_offset = line->offset;
>> -
>> - /*
>> - * max_offset can stay at 0 so it's not an indicator
>> - * of whether line names were configured at all.
>> - */
>> - has_line_names = true;
>> - }
>> + size = max(size, line->offset + 1);
>> }
>
> As for the material to be backported it's fine, but I'm wondering if we
> actually can add the entries in a sorted manner, so we would need the exact
> what I mentioned in previous review round, just search backwards to the first
> satisfying entry. I don't believe the adding an entry to the list is a
> hot-path, so would be fine to call list_sort().
>
Given the need for the callback function, this would result in bigger code.
Also calling:
list_add_tail();
list_sort();
is not very elegant. I would possibly go for adding list_add_sorted() but
that's a separate change for the future.
Bart
On Thu, Sep 21, 2023 at 01:12:16AM -0700, Bartosz Golaszewski wrote:
> On Wed, 20 Sep 2023 15:43:47 +0200, Andy Shevchenko
> <andriy.shevchenko@linux.intel.com> said:
> > On Wed, Sep 20, 2023 at 09:32:53AM +0200, Bartosz Golaszewski wrote:
...
> > As for the material to be backported it's fine, but I'm wondering if we
> > actually can add the entries in a sorted manner, so we would need the exact
> > what I mentioned in previous review round, just search backwards to the first
> > satisfying entry. I don't believe the adding an entry to the list is a
> > hot-path, so would be fine to call list_sort().
>
> Given the need for the callback function, this would result in bigger code.
Is it a problem?
On the below I kinda agree.
> Also calling:
>
> list_add_tail();
> list_sort();
>
> is not very elegant. I would possibly go for adding list_add_sorted() but
> that's a separate change for the future.
Note, we do this for the GPIO bases already.
On Wed, Sep 20, 2023 at 9:32 AM Bartosz Golaszewski <brgl@bgdev.pl> wrote:
>
> From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
>
> gpio_sim_make_line_names() returns NULL or ERR_PTR() so we must not use
> __free(kfree) on the returned address. Split this function into two, one
> that determines the size of the "gpio-line-names" array to allocate and
> one that actually sets the names at correct offsets. The allocation and
> assignment of the managed pointer happens in between.
>
> Fixes: 3faf89f27aab ("gpio: sim: simplify code with cleanup helpers")
> Reported-by: Alexey Dobriyan <adobriyan@gmail.com>
> Closes: https://lore.kernel.org/all/07c32bf1-6c1a-49d9-b97d-f0ae4a2b42ab@p183/
> Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> ---
> Hopefully this is the last version of this patch. I restored the max()
> assignment from v3 but kept the code simpler than v2. Tested most corner
> cases that occurred to me.
>
Patch queued for fixes.
Bartosz
@@ -21,6 +21,7 @@
#include <linux/irq.h>
#include <linux/irq_sim.h>
#include <linux/list.h>
+#include <linux/minmax.h>
#include <linux/mod_devicetable.h>
#include <linux/module.h>
#include <linux/mutex.h>
@@ -718,52 +719,32 @@ gpio_sim_device_config_live_show(struct config_item *item, char *page)
return sprintf(page, "%c\n", live ? '1' : '0');
}
-static char **gpio_sim_make_line_names(struct gpio_sim_bank *bank,
- unsigned int *line_names_size)
+static unsigned int gpio_sim_get_line_names_size(struct gpio_sim_bank *bank)
{
- unsigned int max_offset = 0;
- bool has_line_names = false;
struct gpio_sim_line *line;
- char **line_names;
+ unsigned int size = 0;
list_for_each_entry(line, &bank->line_list, siblings) {
- if (line->offset >= bank->num_lines)
+ if (!line->name || (line->offset >= bank->num_lines))
continue;
- if (line->name) {
- if (line->offset > max_offset)
- max_offset = line->offset;
-
- /*
- * max_offset can stay at 0 so it's not an indicator
- * of whether line names were configured at all.
- */
- has_line_names = true;
- }
+ size = max(size, line->offset + 1);
}
- if (!has_line_names)
- /*
- * This is not an error - NULL means, there are no line
- * names configured.
- */
- return NULL;
-
- *line_names_size = max_offset + 1;
+ return size;
+}
- line_names = kcalloc(*line_names_size, sizeof(*line_names), GFP_KERNEL);
- if (!line_names)
- return ERR_PTR(-ENOMEM);
+static void
+gpio_sim_set_line_names(struct gpio_sim_bank *bank, char **line_names)
+{
+ struct gpio_sim_line *line;
list_for_each_entry(line, &bank->line_list, siblings) {
- if (line->offset >= bank->num_lines)
+ if (!line->name || (line->offset >= bank->num_lines))
continue;
- if (line->name && (line->offset <= max_offset))
- line_names[line->offset] = line->name;
+ line_names[line->offset] = line->name;
}
-
- return line_names;
}
static void gpio_sim_remove_hogs(struct gpio_sim_device *dev)
@@ -867,7 +848,7 @@ gpio_sim_make_bank_swnode(struct gpio_sim_bank *bank,
struct fwnode_handle *parent)
{
struct property_entry properties[GPIO_SIM_PROP_MAX];
- unsigned int prop_idx = 0, line_names_size = 0;
+ unsigned int prop_idx = 0, line_names_size;
char **line_names __free(kfree) = NULL;
memset(properties, 0, sizeof(properties));
@@ -878,14 +859,19 @@ gpio_sim_make_bank_swnode(struct gpio_sim_bank *bank,
properties[prop_idx++] = PROPERTY_ENTRY_STRING("gpio-sim,label",
bank->label);
- line_names = gpio_sim_make_line_names(bank, &line_names_size);
- if (IS_ERR(line_names))
- return ERR_CAST(line_names);
+ line_names_size = gpio_sim_get_line_names_size(bank);
+ if (line_names_size) {
+ line_names = kcalloc(line_names_size, sizeof(*line_names),
+ GFP_KERNEL);
+ if (!line_names)
+ return ERR_PTR(-ENOMEM);
+
+ gpio_sim_set_line_names(bank, line_names);
- if (line_names)
properties[prop_idx++] = PROPERTY_ENTRY_STRING_ARRAY_LEN(
"gpio-line-names",
line_names, line_names_size);
+ }
return fwnode_create_software_node(properties, parent);
}