[PATCH OLK-5.10] hikey9xx: Fixed incorrect use of kfree to free sreg
hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GS86 CVE: NA -------------------------------- When memory allocated by using the devm_kmalloc(). the matching release function should use the devm_kfree() function instead of the kfree() function. @sreg allocated: hi6421_spmi_regulator_probe hi6421_spmi_regulator_probe_ldo @sreg freed: hi6421_spmi_regulator_remove Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com> --- drivers/staging/hikey9xx/hi6421v600-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/hikey9xx/hi6421v600-regulator.c b/drivers/staging/hikey9xx/hi6421v600-regulator.c index 614b03c9ddfb..63204e460f53 100644 --- a/drivers/staging/hikey9xx/hi6421v600-regulator.c +++ b/drivers/staging/hikey9xx/hi6421v600-regulator.c @@ -452,7 +452,7 @@ static int hi6421_spmi_regulator_remove(struct platform_device *pdev) if (rdev->desc->volt_table) devm_kfree(&pdev->dev, (unsigned int *)rdev->desc->volt_table); - kfree(sreg); + devm_kfree(&pdev->dev, sreg); return 0; } -- 2.31.1
From: Lee Jones <lee.jones@linaro.org> mainline inclusion from mainline-v5.11-rc1 commit ab4e4de9fd8b469823a645f05f2c142e9270b012 category: bugfix bugzilla: 188441 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Fixes the following W=1 kernel build warning(s): drivers/mtd/ubi/wl.c:584: warning: Function parameter or member 'nested' not described in 'schedule_erase' drivers/mtd/ubi/wl.c:1075: warning: Excess function parameter 'shutdown' description in '__erase_worker' Cc: Richard Weinberger <richard@nod.at> Cc: Miquel Raynal <miquel.raynal@bootlin.com> Cc: Vignesh Raghavendra <vigneshr@ti.com> Cc: linux-mtd@lists.infradead.org Signed-off-by: Lee Jones <lee.jones@linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://lore.kernel.org/linux-mtd/20201109182206.3037326-13-lee.jones@linaro... Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com> Reviewed-by: Hou Tao <houtao1@huawei.com> --- drivers/mtd/ubi/wl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c index 6da09263e0b9..2ee0e60c43c2 100644 --- a/drivers/mtd/ubi/wl.c +++ b/drivers/mtd/ubi/wl.c @@ -575,6 +575,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk, * @vol_id: the volume ID that last used this PEB * @lnum: the last used logical eraseblock number for the PEB * @torture: if the physical eraseblock has to be tortured + * @nested: denotes whether the work_sem is already held in read mode * * This function returns zero in case of success and a %-ENOMEM in case of * failure. @@ -1066,8 +1067,6 @@ static int ensure_wear_leveling(struct ubi_device *ubi, int nested) * __erase_worker - physical eraseblock erase worker function. * @ubi: UBI device description object * @wl_wrk: the work object - * @shutdown: non-zero if the worker has to free memory and exit - * because the WL sub-system is shutting down * * This function erases a physical eraseblock and perform torture testing if * needed. It also takes care about marking the physical eraseblock bad if -- 2.31.1
maillist inclusion category: bugfix bugzilla: 188441 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?... -------------------------------- During the processing of the bgt, if the sync_erase() return -EBUSY or some other error code in __erase_worker(),schedule_erase() called again lead to the down_read(ubi->work_sem) hold twice and may get block by down_write(ubi->work_sem) in ubi_update_fastmap(), which cause deadlock. ubi bgt other task do_work down_read(&ubi->work_sem) ubi_update_fastmap erase_worker # Blocked by down_read __erase_worker down_write(&ubi->work_sem) schedule_erase schedule_ubi_work down_read(&ubi->work_sem) Fix this by changing input parameter @nested of the schedule_erase() to 'true' to avoid recursively acquiring the down_read(&ubi->work_sem). Also, fix the incorrect comment about @nested parameter of the schedule_erase() because when down_write(ubi->work_sem) is held, the @nested is also need be true. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217093 Fixes: 2e8f08deabbc ("ubi: Fix races around ubi_refill_pools()") Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com> Reviewed-by: Hou Tao <houtao1@huawei.com> --- drivers/mtd/ubi/wl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c index 2ee0e60c43c2..4427018ad4d9 100644 --- a/drivers/mtd/ubi/wl.c +++ b/drivers/mtd/ubi/wl.c @@ -575,7 +575,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk, * @vol_id: the volume ID that last used this PEB * @lnum: the last used logical eraseblock number for the PEB * @torture: if the physical eraseblock has to be tortured - * @nested: denotes whether the work_sem is already held in read mode + * @nested: denotes whether the work_sem is already held * * This function returns zero in case of success and a %-ENOMEM in case of * failure. @@ -1121,7 +1121,7 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk) int err1; /* Re-schedule the LEB for erasure */ - err1 = schedule_erase(ubi, e, vol_id, lnum, 0, false); + err1 = schedule_erase(ubi, e, vol_id, lnum, 0, true); if (err1) { spin_lock(&ubi->wl_lock); wl_entry_destroy(ubi, e); -- 2.31.1
hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6GS86 CVE: NA -------------------------------- When memory allocated by using the devm_kmalloc(). the matching release function should use the devm_kfree() function instead of the kfree() function. @sreg allocated: hi6421_spmi_regulator_probe hi6421_spmi_regulator_probe_ldo @sreg freed: hi6421_spmi_regulator_remove Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com> --- drivers/staging/hikey9xx/hi6421v600-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/hikey9xx/hi6421v600-regulator.c b/drivers/staging/hikey9xx/hi6421v600-regulator.c index 614b03c9ddfb..63204e460f53 100644 --- a/drivers/staging/hikey9xx/hi6421v600-regulator.c +++ b/drivers/staging/hikey9xx/hi6421v600-regulator.c @@ -452,7 +452,7 @@ static int hi6421_spmi_regulator_remove(struct platform_device *pdev) if (rdev->desc->volt_table) devm_kfree(&pdev->dev, (unsigned int *)rdev->desc->volt_table); - kfree(sreg); + devm_kfree(&pdev->dev, sreg); return 0; } -- 2.31.1
participants (1)
-
ZhaoLong Wang