diff mbox series

mm: dmapool: Check the dma pool name

Message ID 59623b15001e5a20ac32b1a393db88722be2e718.1527679621.git.baolin.wang@linaro.org
State New
Headers show
Series mm: dmapool: Check the dma pool name | expand

Commit Message

(Exiting) Baolin Wang May 30, 2018, 11:28 a.m. UTC
It will be crash if we pass one NULL name when creating one dma pool,
so we should check the passing name when copy it to dma pool.

Moreover this patch replaces kmalloc_node() with kzalloc_node() to make
sure the name array of dma pool is initialized in case the passing name
is NULL.

Signed-off-by: Baolin Wang <baolin.wang@linaro.org>

---
 mm/dmapool.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

-- 
1.7.9.5

Comments

Matthew Wilcox May 30, 2018, 12:01 p.m. UTC | #1
On Wed, May 30, 2018 at 07:28:43PM +0800, Baolin Wang wrote:
> It will be crash if we pass one NULL name when creating one dma pool,

> so we should check the passing name when copy it to dma pool.


NAK.  Crashing is the appropriate thing to do.  Fix the caller to not
pass NULL.

If you permit NULL to be passed then you're inviting crashes or just
bad reporting later when pool->name is printed.
(Exiting) Baolin Wang May 30, 2018, 12:14 p.m. UTC | #2
On 30 May 2018 at 20:01, Matthew Wilcox <willy@infradead.org> wrote:
> On Wed, May 30, 2018 at 07:28:43PM +0800, Baolin Wang wrote:

>> It will be crash if we pass one NULL name when creating one dma pool,

>> so we should check the passing name when copy it to dma pool.

>

> NAK.  Crashing is the appropriate thing to do.  Fix the caller to not

> pass NULL.

>

> If you permit NULL to be passed then you're inviting crashes or just

> bad reporting later when pool->name is printed.


I think it just prints one NULL pool name. Sometimes the device
doesn't care the dma pool names, so I think we can make code more
solid to valid the passing parameters like other code does.
Or can we add check to return NULL when the passing name is NULL
instead of crashing the kernel? Thanks.

-- 
Baolin.wang
Best Regards
Matthew Wilcox May 30, 2018, 3:13 p.m. UTC | #3
On Wed, May 30, 2018 at 08:14:09PM +0800, Baolin Wang wrote:
> On 30 May 2018 at 20:01, Matthew Wilcox <willy@infradead.org> wrote:

> > On Wed, May 30, 2018 at 07:28:43PM +0800, Baolin Wang wrote:

> >> It will be crash if we pass one NULL name when creating one dma pool,

> >> so we should check the passing name when copy it to dma pool.

> >

> > NAK.  Crashing is the appropriate thing to do.  Fix the caller to not

> > pass NULL.

> >

> > If you permit NULL to be passed then you're inviting crashes or just

> > bad reporting later when pool->name is printed.

> 

> I think it just prints one NULL pool name. Sometimes the device

> doesn't care the dma pool names, so I think we can make code more

> solid to valid the passing parameters like other code does.

> Or can we add check to return NULL when the passing name is NULL

> instead of crashing the kernel? Thanks.


No.  Fix your driver.
Matthew Wilcox May 30, 2018, 3:41 p.m. UTC | #4
On Wed, May 30, 2018 at 08:13:27AM -0700, Matthew Wilcox wrote:
> On Wed, May 30, 2018 at 08:14:09PM +0800, Baolin Wang wrote:

> > On 30 May 2018 at 20:01, Matthew Wilcox <willy@infradead.org> wrote:

> > > On Wed, May 30, 2018 at 07:28:43PM +0800, Baolin Wang wrote:

> > >> It will be crash if we pass one NULL name when creating one dma pool,

> > >> so we should check the passing name when copy it to dma pool.

> > >

> > > NAK.  Crashing is the appropriate thing to do.  Fix the caller to not

> > > pass NULL.

> > >

> > > If you permit NULL to be passed then you're inviting crashes or just

> > > bad reporting later when pool->name is printed.

> > 

> > I think it just prints one NULL pool name. Sometimes the device

> > doesn't care the dma pool names, so I think we can make code more

> > solid to valid the passing parameters like other code does.

> > Or can we add check to return NULL when the passing name is NULL

> > instead of crashing the kernel? Thanks.

> 

> No.  Fix your driver.


Let me elaborate on this.  Kernel code is supposed to be "reasonable".
That means we don't check every argument to every function for sanity,
unless it's going to cause trouble later.  Crashing immediately with
a bogus argument is fine; you can see the problem and fix it immediately.
Returning NULL with a bad argument is actually worse; you won't know why
the function returned NULL (maybe we're out of memory?) and you'll have
a more complex debugging experience.

Sometimes it makes sense to accept a NULL pointer and do something
reasonable, like kfree().  In this case, we can eliminate checks in all
the callers.  But we don't, in general, put sanity checks on arguments
without a good reason.

Your reasons aren't good.  "The driver doesn't care" -- well, just pass
the driver's name, then.
(Exiting) Baolin Wang May 31, 2018, 2:34 a.m. UTC | #5
On 30 May 2018 at 23:41, Matthew Wilcox <willy@infradead.org> wrote:
> On Wed, May 30, 2018 at 08:13:27AM -0700, Matthew Wilcox wrote:

>> On Wed, May 30, 2018 at 08:14:09PM +0800, Baolin Wang wrote:

>> > On 30 May 2018 at 20:01, Matthew Wilcox <willy@infradead.org> wrote:

>> > > On Wed, May 30, 2018 at 07:28:43PM +0800, Baolin Wang wrote:

>> > >> It will be crash if we pass one NULL name when creating one dma pool,

>> > >> so we should check the passing name when copy it to dma pool.

>> > >

>> > > NAK.  Crashing is the appropriate thing to do.  Fix the caller to not

>> > > pass NULL.

>> > >

>> > > If you permit NULL to be passed then you're inviting crashes or just

>> > > bad reporting later when pool->name is printed.

>> >

>> > I think it just prints one NULL pool name. Sometimes the device

>> > doesn't care the dma pool names, so I think we can make code more

>> > solid to valid the passing parameters like other code does.

>> > Or can we add check to return NULL when the passing name is NULL

>> > instead of crashing the kernel? Thanks.

>>

>> No.  Fix your driver.

>

> Let me elaborate on this.  Kernel code is supposed to be "reasonable".

> That means we don't check every argument to every function for sanity,

> unless it's going to cause trouble later.  Crashing immediately with

> a bogus argument is fine; you can see the problem and fix it immediately.

> Returning NULL with a bad argument is actually worse; you won't know why

> the function returned NULL (maybe we're out of memory?) and you'll have

> a more complex debugging experience.

>

> Sometimes it makes sense to accept a NULL pointer and do something

> reasonable, like kfree().  In this case, we can eliminate checks in all

> the callers.  But we don't, in general, put sanity checks on arguments

> without a good reason.

>

> Your reasons aren't good.  "The driver doesn't care" -- well, just pass

> the driver's name, then.


Thanks for your explanation. OK, force the driver to pass a pool name.
Sorry for noises.

-- 
Baolin.wang
Best Regards
diff mbox series

Patch

diff --git a/mm/dmapool.c b/mm/dmapool.c
index 4d90a64..349f13d 100644
--- a/mm/dmapool.c
+++ b/mm/dmapool.c
@@ -155,11 +155,12 @@  struct dma_pool *dma_pool_create(const char *name, struct device *dev,
 	else if ((boundary < size) || (boundary & (boundary - 1)))
 		return NULL;
 
-	retval = kmalloc_node(sizeof(*retval), GFP_KERNEL, dev_to_node(dev));
+	retval = kzalloc_node(sizeof(*retval), GFP_KERNEL, dev_to_node(dev));
 	if (!retval)
 		return retval;
 
-	strlcpy(retval->name, name, sizeof(retval->name));
+	if (name)
+		strlcpy(retval->name, name, sizeof(retval->name));
 
 	retval->dev = dev;