From e9d92e40ac9dea5a9a185fc11227f492f0b74fc7 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Tue, 28 Nov 2017 09:25:23 +0100 Subject: of: Spelling s/changset/changeset/ Signed-off-by: Geert Uytterhoeven Signed-off-by: Rob Herring --- drivers/of/overlay.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'drivers/of/overlay.c') diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c index c150abb9049d..3036f1776efc 100644 --- a/drivers/of/overlay.c +++ b/drivers/of/overlay.c @@ -660,14 +660,14 @@ static void free_overlay_changeset(struct overlay_changeset *ovcs) * A non-zero return value will not have created the changeset if error is from: * - parameter checks * - building the changeset - * - overlay changset pre-apply notifier + * - overlay changeset pre-apply notifier * * If an error is returned by an overlay changeset pre-apply notifier * then no further overlay changeset pre-apply notifier will be called. * * A non-zero return value will have created the changeset if error is from: * - overlay changeset entry notifier - * - overlay changset post-apply notifier + * - overlay changeset post-apply notifier * * If an error is returned by an overlay changeset post-apply notifier * then no further overlay changeset post-apply notifier will be called. @@ -871,7 +871,7 @@ static int overlay_removal_is_ok(struct overlay_changeset *remove_ovcs) * * A non-zero return value will not revert the changeset if error is from: * - parameter checks - * - overlay changset pre-remove notifier + * - overlay changeset pre-remove notifier * - overlay changeset entry revert * * If an error is returned by an overlay changeset pre-remove notifier @@ -882,7 +882,7 @@ static int overlay_removal_is_ok(struct overlay_changeset *remove_ovcs) * * A non-zero return value will revert the changeset if error is from: * - overlay changeset entry notifier - * - overlay changset post-remove notifier + * - overlay changeset post-remove notifier * * If an error is returned by an overlay changeset post-remove notifier * then no further overlay changeset post-remove notifier will be called. -- cgit v1.2.3 From 6de67de326041c3a450a117b2733cbedd3aab097 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Tue, 28 Nov 2017 09:26:33 +0100 Subject: of: overlay: Remove else after goto If an "if" branch is terminated by a "goto", there's no need to have an "else" statement and an indented block of code. Remove the "else" statement to simplify the code flow for the casual reviewer. Signed-off-by: Geert Uytterhoeven Signed-off-by: Rob Herring --- drivers/of/overlay.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) (limited to 'drivers/of/overlay.c') diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c index 3036f1776efc..2b852a39581e 100644 --- a/drivers/of/overlay.c +++ b/drivers/of/overlay.c @@ -580,9 +580,9 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs, of_node_put(fragment->overlay); ret = -EINVAL; goto err_free_fragments; - } else { - cnt++; } + + cnt++; } } @@ -736,14 +736,13 @@ int of_overlay_apply(struct device_node *tree, int *ovcs_id) devicetree_state_flags |= DTSF_APPLY_FAIL; } goto err_free_overlay_changeset; - } else { - ret = __of_changeset_apply_notify(&ovcs->cset); - if (ret) - pr_err("overlay changeset entry notify error %d\n", - ret); - /* fall through */ } + ret = __of_changeset_apply_notify(&ovcs->cset); + if (ret) + pr_err("overlay changeset entry notify error %d\n", ret); + /* notify failure is not fatal, continue */ + list_add_tail(&ovcs->ovcs_list, &ovcs_list); *ovcs_id = ovcs->id; @@ -931,15 +930,13 @@ int of_overlay_remove(int *ovcs_id) if (ret_apply) devicetree_state_flags |= DTSF_REVERT_FAIL; goto out_unlock; - } else { - ret = __of_changeset_revert_notify(&ovcs->cset); - if (ret) { - pr_err("overlay changeset entry notify error %d\n", - ret); - /* fall through - changeset was reverted */ - } } + ret = __of_changeset_revert_notify(&ovcs->cset); + if (ret) + pr_err("overlay changeset entry notify error %d\n", ret); + /* notify failure is not fatal, continue */ + *ovcs_id = 0; ret_tmp = overlay_notify(ovcs, OF_OVERLAY_POST_REMOVE); -- cgit v1.2.3 From 1352f09b4cc4f9dce386620b118401738bbf0d5f Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Tue, 5 Dec 2017 16:27:02 +0100 Subject: of: overlay: Fix memory leak in of_overlay_apply() error path If of_resolve_phandles() fails, free_overlay_changeset() is called in the error path. However, that function returns early if the list hasn't been initialized yet, before freeing the object. Explicitly calling kfree() instead would solve that issue. However, that complicates matter, by having to consider which of two different methods to use to dispose of the same object. Hence make free_overlay_changeset() consider initialization state of the different parts of the object, making it always safe to call (once!) to dispose of a (partially) initialized overlay_changeset: - Only destroy the changeset if the list was initialized, - Make init_overlay_changeset() store the ID in ovcs->id on success, to avoid calling idr_remove() with an error value or an already released ID. Reported-by: Colin King Fixes: f948d6d8b792bb90 ("of: overlay: avoid race condition between applying multiple overlays") Signed-off-by: Geert Uytterhoeven Reviewed-by: Frank Rowand Signed-off-by: Rob Herring --- drivers/of/overlay.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'drivers/of/overlay.c') diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c index 2b852a39581e..bb3f123ed259 100644 --- a/drivers/of/overlay.c +++ b/drivers/of/overlay.c @@ -522,7 +522,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs, struct device_node *node, *overlay_node; struct fragment *fragment; struct fragment *fragments; - int cnt, ret; + int cnt, id, ret; /* * Warn for some issues. Can not return -EINVAL for these until @@ -543,9 +543,9 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs, of_changeset_init(&ovcs->cset); - ovcs->id = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL); - if (ovcs->id <= 0) - return ovcs->id; + id = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL); + if (id <= 0) + return id; cnt = 0; @@ -611,6 +611,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs, goto err_free_fragments; } + ovcs->id = id; ovcs->count = cnt; ovcs->fragments = fragments; @@ -619,7 +620,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs, err_free_fragments: kfree(fragments); err_free_idr: - idr_remove(&ovcs_idr, ovcs->id); + idr_remove(&ovcs_idr, id); pr_err("%s() failed, ret = %d\n", __func__, ret); @@ -630,9 +631,8 @@ static void free_overlay_changeset(struct overlay_changeset *ovcs) { int i; - if (!ovcs->cset.entries.next) - return; - of_changeset_destroy(&ovcs->cset); + if (ovcs->cset.entries.next) + of_changeset_destroy(&ovcs->cset); if (ovcs->id) idr_remove(&ovcs_idr, ovcs->id); -- cgit v1.2.3 From 5e4748175fe942c86cbab840e2fa41a92b4d6cf6 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Tue, 5 Dec 2017 16:27:03 +0100 Subject: of: overlay: Fix (un)locking in of_overlay_apply() The special overlay mutex is taken first, hence it should be released last in the error path. of_resolve_phandles() must be called with of_mutex held. Without it, a node and new phandle could be added via of_attach_node(), making the max phandle wrong. free_overlay_changeset() must be called with of_mutex held, if any non-trivial cleanup is to be done. Hence move "mutex_lock(&of_mutex)" up, as suggested by Frank, and merge the two tail statements of the success and error paths, now they became identical. Note that while the two mutexes are adjacent, we still need both: __of_changeset_apply_notify(), which is called by __of_changeset_apply() unlocks of_mutex, then does notifications then locks of_mutex. So the mutex get released in the middle of of_overlay_apply() Fixes: f948d6d8b792bb90 ("of: overlay: avoid race condition between applying multiple overlays") Signed-off-by: Geert Uytterhoeven Reviewed-by: Frank Rowand Signed-off-by: Rob Herring --- drivers/of/overlay.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) (limited to 'drivers/of/overlay.c') diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c index bb3f123ed259..fcce5cdbe229 100644 --- a/drivers/of/overlay.c +++ b/drivers/of/overlay.c @@ -706,12 +706,11 @@ int of_overlay_apply(struct device_node *tree, int *ovcs_id) } of_overlay_mutex_lock(); + mutex_lock(&of_mutex); ret = of_resolve_phandles(tree); if (ret) - goto err_overlay_unlock; - - mutex_lock(&of_mutex); + goto err_free_overlay_changeset; ret = init_overlay_changeset(ovcs, tree); if (ret) @@ -754,18 +753,14 @@ int of_overlay_apply(struct device_node *tree, int *ovcs_id) ret = ret_tmp; } - mutex_unlock(&of_mutex); - of_overlay_mutex_unlock(); - - goto out; - -err_overlay_unlock: - of_overlay_mutex_unlock(); + goto out_unlock; err_free_overlay_changeset: free_overlay_changeset(ovcs); +out_unlock: mutex_unlock(&of_mutex); + of_overlay_mutex_unlock(); out: pr_debug("%s() err=%d\n", __func__, ret); -- cgit v1.2.3 From 35e691eddca565f475ba69ff84ca0c9db3b3257b Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Fri, 8 Dec 2017 14:13:02 +0100 Subject: of: overlay: Fix out-of-bounds write in init_overlay_changeset() If an overlay has no "__symbols__" node, but it has nodes without "__overlay__" subnodes at the end (e.g. a "__fixups__" node), after filling in all fragments for nodes with "__overlay__" subnodes, "fragment = &fragments[cnt]" will point beyond the end of the allocated array. Hence writing to "fragment->overlay" will overwrite unallocated memory, which may lead to a crash later. Fix this by deferring both the assignment to "fragment" and the offending write afterwards until we know for sure the node has an "__overlay__" subnode, and thus a valid entry in "fragments[]". Fixes: 61b4de4e0b384f4a ("of: overlay: minor restructuring") Signed-off-by: Geert Uytterhoeven Signed-off-by: Rob Herring --- drivers/of/overlay.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'drivers/of/overlay.c') diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c index fcce5cdbe229..83bb2edfc65c 100644 --- a/drivers/of/overlay.c +++ b/drivers/of/overlay.c @@ -572,9 +572,10 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs, cnt = 0; for_each_child_of_node(tree, node) { - fragment = &fragments[cnt]; - fragment->overlay = of_get_child_by_name(node, "__overlay__"); - if (fragment->overlay) { + overlay_node = of_get_child_by_name(node, "__overlay__"); + if (overlay_node) { + fragment = &fragments[cnt]; + fragment->overlay = overlay_node; fragment->target = find_target_node(node); if (!fragment->target) { of_node_put(fragment->overlay); -- cgit v1.2.3 From 589b754df3f37ca0a1f96fccde7f91c59266f38a Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Fri, 8 Dec 2017 14:13:03 +0100 Subject: of: overlay: Make node skipping in init_overlay_changeset() clearer Make it more clear that nodes without "__overlay__" subnodes are skipped, by reverting the logic and using continue. This also reduces indentation level. Signed-off-by: Geert Uytterhoeven Signed-off-by: Rob Herring --- drivers/of/overlay.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) (limited to 'drivers/of/overlay.c') diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c index 83bb2edfc65c..3981b7da4fa9 100644 --- a/drivers/of/overlay.c +++ b/drivers/of/overlay.c @@ -573,18 +573,19 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs, cnt = 0; for_each_child_of_node(tree, node) { overlay_node = of_get_child_by_name(node, "__overlay__"); - if (overlay_node) { - fragment = &fragments[cnt]; - fragment->overlay = overlay_node; - fragment->target = find_target_node(node); - if (!fragment->target) { - of_node_put(fragment->overlay); - ret = -EINVAL; - goto err_free_fragments; - } + if (!overlay_node) + continue; - cnt++; + fragment = &fragments[cnt]; + fragment->overlay = overlay_node; + fragment->target = find_target_node(node); + if (!fragment->target) { + of_node_put(fragment->overlay); + ret = -EINVAL; + goto err_free_fragments; } + + cnt++; } /* -- cgit v1.2.3