mlxsw: core: Use devm_kzalloc to allocate mlxsw_hwmon structure

KASan reported use-after-free for the hwmon structure. So fix this by
using devm_kzalloc and let the core take care about freeing the memory
during device dettach.

Reported-by: Ido Schimmel <idosch@mellanox.com>
Fixes: 89309da39 ("mlxsw: core: Implement temperature hwmon interface")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index af8a48b3b3ad6e0a07ddcff9ee4dc0d4d5f41a48..22379eb8e92458612b7a5a8e74cc1decd8dc0629 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -855,7 +855,6 @@ int mlxsw_core_bus_device_register(const struct mlxsw_bus_info *mlxsw_bus_info,
 err_debugfs_init:
        mlxsw_core->driver->fini(mlxsw_core->driver_priv);
 err_driver_init:
-       mlxsw_hwmon_fini(mlxsw_core->hwmon);
 err_hwmon_init:
        mlxsw_emad_fini(mlxsw_core);
 err_emad_init:
@@ -878,7 +877,6 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core)
 
        mlxsw_core_debugfs_fini(mlxsw_core);
        mlxsw_core->driver->fini(mlxsw_core->driver_priv);
-       mlxsw_hwmon_fini(mlxsw_core->hwmon);
        mlxsw_emad_fini(mlxsw_core);
        mlxsw_core->bus->fini(mlxsw_core->bus_priv);
        kfree(mlxsw_core->lag.mapping);

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.h b/drivers/net/ethernet/mellanox/mlxsw/core.h
index 4833fb33ce07a1903b04ef527459ac6b6aaaa2e1..a01723600f0ae801139099e872a4fa2585a36e2f 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlxsw/core.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.h
@@ -239,10 +239,6 @@ static inline int mlxsw_hwmon_init(struct mlxsw_core *mlxsw_core,
        return 0;
 }
 
-static inline void mlxsw_hwmon_fini(struct mlxsw_hwmon *mlxsw_hwmon)
-{
-}
-
 #endif
 
 #endif

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
index 00ccf1c0dcda7218a666c223a585e1c9e7f3421e..5b9364f4837df3ed3928411b69ee6262b43e0010 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
@@ -334,7 +334,8 @@ int mlxsw_hwmon_init(struct mlxsw_core *mlxsw_core,
        struct device *hwmon_dev;
        int err;
 
-       mlxsw_hwmon = kzalloc(sizeof(*mlxsw_hwmon), GFP_KERNEL);
+       mlxsw_hwmon = devm_kzalloc(mlxsw_bus_info->dev, sizeof(*mlxsw_hwmon),
+                                  GFP_KERNEL);
        if (!mlxsw_hwmon)
                return -ENOMEM;
        mlxsw_hwmon->core = mlxsw_core;
@@ -367,11 +368,5 @@ int mlxsw_hwmon_init(struct mlxsw_core *mlxsw_core,
 err_hwmon_register:
 err_fans_init:
 err_temp_init:
-       kfree(mlxsw_hwmon);
        return err;
 }
-
-void mlxsw_hwmon_fini(struct mlxsw_hwmon *mlxsw_hwmon)
-{
-       kfree(mlxsw_hwmon);
-}