From f75587b8ca69768c6cf8a38a0b61e68e1bea3d36 Mon Sep 17 00:00:00 2001 From: Nishanth Menon Date: Fri, 1 Apr 2016 08:52:47 -0500 Subject: [PATCH 1/4] extcon: palmas: Drop stray IRQF_EARLY_RESUME flag Palmas extcon IRQs are nested threaded and wired to the Palmas interrupt controller. So, this flag is not required for nested IRQs anymore, since commit 3c646f2c6aa9 ("genirq: Don't suspend nested_thread irqs over system suspend") was merged. However, the fix in commit ae64e42cc2b3 ("extcon: palmas: Drop IRQF_EARLY_RESUME flag") missed a stray flag causing the following crash on resume on BeagleBoard-X15 platform: [ 53.670141] Unhandled fault: imprecise external abort (0x1406) at 0x00000000 [..] [ 53.670141] [] (omap_set_gpio_triggering) from [] (omap_gpio_unmask_irq+0xc0/0xc4) [ 53.670141] [] (omap_gpio_unmask_irq) from [] (irq_enable+0x30/0x44) [ 53.670141] [] (irq_enable) from [] (__enable_irq+0x54/0x78) [ 53.670141] [] (__enable_irq) from [] (resume_irqs+0xe8/0x100) [ 53.670141] [] (resume_irqs) from [] (syscore_resume+0x94/0x298) [ 53.670141] [] (syscore_resume) from [] (suspend_devices_and_enter+0x790/0x9e4) [ 53.670141] [] (suspend_devices_and_enter) from [] (pm_suspend+0x640/0x75c) [ 53.670141] [] (pm_suspend) from [] (state_store+0x64/0xb8) [ 53.670141] [] (state_store) from [] (kernfs_fop_write+0xc0/0x1bc) [ 53.670141] [] (kernfs_fop_write) from [] (__vfs_write+0x1c/0xd8) [ 53.670141] [] (__vfs_write) from [] (vfs_write+0x90/0x16c) [ 53.670141] [] (vfs_write) from [] (SyS_write+0x44/0x9c) [ 53.670141] [] (SyS_write) from [] (ret_fast_syscall+0x0/0x1c) [..] Fixes: ae64e42cc2b3 ("extcon: palmas: Drop IRQF_EARLY_RESUME flag") Cc: Grygorii Strashko Cc: MyungJoo Ham Cc: Chanwoo Choi Cc: Tony Lindgren Cc: Lee Jones Cc: Roger Quadros Reviewed-by: Grygorii Strashko Signed-off-by: Nishanth Menon Acked-by: Roger Quadros Signed-off-by: Chanwoo Choi --- drivers/extcon/extcon-palmas.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/extcon/extcon-palmas.c b/drivers/extcon/extcon-palmas.c index 841a4b586395..8b3226dca1d9 100644 --- a/drivers/extcon/extcon-palmas.c +++ b/drivers/extcon/extcon-palmas.c @@ -348,8 +348,7 @@ static int palmas_usb_probe(struct platform_device *pdev) palmas_vbus_irq_handler, IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING | - IRQF_ONESHOT | - IRQF_EARLY_RESUME, + IRQF_ONESHOT, "palmas_usb_vbus", palmas_usb); if (status < 0) { From 50fbd977733d1cbafe75baf4b50424434dcfea8c Mon Sep 17 00:00:00 2001 From: Sudip Mukherjee Date: Tue, 5 Apr 2016 22:41:05 +0530 Subject: [PATCH 2/4] lkdtm: fix memory leak of val This case is supposed to read from a page after after it is freed, but it missed freeing val if we are not able to get a free page. Signed-off-by: Sudip Mukherjee Signed-off-by: Kees Cook --- drivers/misc/lkdtm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c index 5f1a36b8fbb0..2f0b02248761 100644 --- a/drivers/misc/lkdtm.c +++ b/drivers/misc/lkdtm.c @@ -498,12 +498,13 @@ static void lkdtm_do_action(enum ctype which) } case CT_READ_BUDDY_AFTER_FREE: { unsigned long p = __get_free_page(GFP_KERNEL); - int saw, *val = kmalloc(1024, GFP_KERNEL); + int saw, *val; int *base; if (!p) break; + val = kmalloc(1024, GFP_KERNEL); if (!val) break; From d2e10088ce01191748857296999b8c24a9a51959 Mon Sep 17 00:00:00 2001 From: Sudip Mukherjee Date: Tue, 5 Apr 2016 22:41:06 +0530 Subject: [PATCH 3/4] lkdtm: fix memory leak of base This case is supposed to read from a memory after it has been freed, but we missed freeing base if the memory 'val' could not be allocated. Signed-off-by: Sudip Mukherjee Signed-off-by: Kees Cook --- drivers/misc/lkdtm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c index 2f0b02248761..5b3a63c87ec9 100644 --- a/drivers/misc/lkdtm.c +++ b/drivers/misc/lkdtm.c @@ -458,8 +458,10 @@ static void lkdtm_do_action(enum ctype which) break; val = kmalloc(len, GFP_KERNEL); - if (!val) + if (!val) { + kfree(base); break; + } *val = 0x12345678; base[offset] = *val; From 3d085c7413d32bb6895e5b9b5ee6a7d2180159c5 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Wed, 6 Apr 2016 15:53:27 -0700 Subject: [PATCH 4/4] lkdtm: do not leak free page on kmalloc failure This frees the allocated page if there is a kmalloc failure. Signed-off-by: Kees Cook --- drivers/misc/lkdtm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c index 5b3a63c87ec9..0a5cbbe12452 100644 --- a/drivers/misc/lkdtm.c +++ b/drivers/misc/lkdtm.c @@ -507,8 +507,10 @@ static void lkdtm_do_action(enum ctype which) break; val = kmalloc(1024, GFP_KERNEL); - if (!val) + if (!val) { + free_page(p); break; + } base = (int *)p;