Skip to contentSkip to conversation

soc: imx9: devm_kasprintf error handling

PATCH Applied Greg Kroah-Hartman 3 participants 3 messages Jul 6 – Jul 13 Arm i.MX and Layerscape

lore
Share & tools
lore

Greg Kroah-Hartman

author
#0 lore raw

PATCH 1/1 soc: imx9: devm_kasprintf error handling

From: Griffin Kroah-Hartman <[email protected]>

Add error handling to devm_kasprintf functions in imx9_soc_probe().

Assisted-by gkh_clanker_2000
Cc Frank Li <[email protected]>
Cc Sascha Hauer <[email protected]>
Cc Pengutronix Kernel Team <[email protected]>
Cc Fabio Estevam <[email protected]>
Cc Peng Fan <[email protected]>
Cc Shawn Guo <[email protected]>
Cc Bartosz Golaszewski <[email protected]>
Signed-off-by Griffin Kroah-Hartman <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/soc/imx/soc-imx9.c | 9 +++++++++
 1 file changed, 9 insertions(+)
drivers/soc/imx/soc-imx9.c +9 -0
index 58eef7d4f908..23b54b7d7502 100644
@@ -35,6 +35,8 @@ static int imx9_soc_probe(struct platform_device *pdev)
 		return dev_err_probe(dev, err, "%s: missing model property\n", __func__);
 
 	attr->family = devm_kasprintf(dev, GFP_KERNEL, "Freescale i.MX");
+	if (!attr->family)
+		return -ENOMEM;
 
 	/*
 	 * Retrieve the soc id, rev & uid info:

@@ -52,11 +54,18 @@ static int imx9_soc_probe(struct platform_device *pdev)
 	rev_minor = SOC_REV_MINOR(res.a1);
 
 	attr->soc_id = devm_kasprintf(dev, GFP_KERNEL, "i.MX%2x", soc_id);
+	if (!attr->soc_id)
+		return -ENOMEM;
+
 	attr->revision = devm_kasprintf(dev, GFP_KERNEL, "%d.%d", rev_major, rev_minor);
+	if (!attr->revision)
+		return -ENOMEM;
 
 	uid127_64 = res.a2;
 	uid63_0 = res.a3;
 	attr->serial_number = devm_kasprintf(dev, GFP_KERNEL, "%016llx%016llx", uid127_64, uid63_0);
+	if (!attr->serial_number)
+		return -ENOMEM;
 
 	sdev = soc_device_register(attr);
 	if (IS_ERR(sdev))
Signature · 1 line
2.55.0
AI review
#1 lore raw
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing unregister mechanism for the SoC device causes a Use-After-Free if the driver is unbound via sysfs. --

commit 84c9267e8e5f768b0aa5bc1444220a55eb7de229
Author: Griffin Kroah-Hartman <[email protected]>

soc: imx9: devm_kasprintf error handling

This commit adds error handling to devm_kasprintf calls in imx9_soc_probe(), ensuring that memory allocation failures return -ENOMEM rather than silently continuing.

Quoted 4 lines
drivers/soc/imx/soc-imx9.c +0 -0
index 58eef7d4f9089..23b54b7d75027 100644

[ ... ]

Quoted 19 lines
drivers/soc/imx/soc-imx9.c +7 -0
@@ -52,11 +54,18 @@ static int imx9_soc_probe(struct platform_device *pdev)
 	rev_minor = SOC_REV_MINOR(res.a1);
 
 	attr->soc_id = devm_kasprintf(dev, GFP_KERNEL, "i.MX%2x", soc_id);
+	if (!attr->soc_id)
+		return -ENOMEM;
+
 	attr->revision = devm_kasprintf(dev, GFP_KERNEL, "%d.%d", rev_major, rev_minor);
+	if (!attr->revision)
+		return -ENOMEM;
 
 	uid127_64 = res.a2;
 	uid63_0 = res.a3;
 	attr->serial_number = devm_kasprintf(dev, GFP_KERNEL, "%016llx%016llx", uid127_64, uid63_0);
+	if (!attr->serial_number)
+		return -ENOMEM;
 
 	sdev = soc_device_register(attr);
 	if (IS_ERR(sdev))

drivers/soc/imx/soc-imx9.c

Quoted 5 lines
drivers/soc/imx/soc-imx9.c +0 -0
 		return dev_err_probe(dev, PTR_ERR(sdev),
 				     "%s failed to register SoC as a device\n", __func__);
 
 	return 0;
 }

[Severity: High]
This is a pre-existing issue, but does imx9_soc_probe() lack a way to unregister the soc_device on driver unbind?

If the imx9-soc driver is unbound via sysfs, the driver core will call devres_release_all() and free the devm-managed attr structure, along with the strings allocated by devm_kasprintf().

Because soc_device_unregister() is never called to complement soc_device_register(), the soc_device remains active in the system.

Could this lead to a use-after-free if a user later reads the soc_device sysfs attributes (like /sys/devices/soc0/family) which reference the freed attr memory?

Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/2026070610-regime-badge-e99b@gregkh?part=1