Re: [PATCH] kernel/resource: Fix return code check in __request_free_mem_region

[David Hildenbrand]

On 12.05.21 09:35, Alistair Popple wrote:
> Splitting an earlier version of a patch that allowed calling
> __request_region() while holding the resource lock into a series of
> patches required changing the return code for the newly introduced
> __request_region_locked().
>
> Unfortunately this change was not carried through to a subsequent
> commit 56fd94919b8b ("kernel/resource: fix locking in
> request_free_mem_region") in the series. This resulted in a
> use-after-free due to freeing the struct resource without properly
> releasing it. Fix this by correcting the return code check so that the
> struct is not freed if the request to add it was successful.
>
> Reported-by: kernel test robot <oliver.sang@xxxxxxxxx>
> Fixes: 56fd94919b8b ("kernel/resource: fix locking in request_free_mem_region")
> Signed-off-by: Alistair Popple <apopple@xxxxxxxxxx>
> ---
>   kernel/resource.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/resource.c b/kernel/resource.c
> index 028a5ab18818..ca9f5198a01f 100644
> --- a/kernel/resource.c
> +++ b/kernel/resource.c
> @@ -1805,7 +1805,7 @@ static struct resource *__request_free_mem_region(struct device *dev,
>   				REGION_DISJOINT)
>   			continue;
>   
> -		if (!__request_region_locked(res, &iomem_resource, addr, size,
> +		if (__request_region_locked(res, &iomem_resource, addr, size,
>   						name, 0))
>   			break;
>   

Ouch, missed that, would have expected this pops up right away when testing.

Reviewed-by: David Hildenbrand <david@xxxxxxxxxx>

--
Thanks,

David / dhildenb