linux-kernel - Re: [PATCH] mtd: maps: add missing iounmap() in error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 22 Nov 2016 11:21:24 -0800
From:   Brian Norris <computersforpeace@...il.com>
To:     Luis Henriques <henrix@...andro.org>
Cc:     David Woodhouse <dwmw2@...radead.org>,
        Boris Brezillon <boris.brezillon@...e-electrons.com>,
        Marek Vasut <marek.vasut@...il.com>,
        Richard Weinberger <richard@....at>,
        Cyrille Pitchen <cyrille.pitchen@...el.com>,
        linux-mtd@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mtd: maps: add missing iounmap() in error path

On Wed, Nov 16, 2016 at 10:50:16PM +0000, Luis Henriques wrote:
> This patch was triggered by the following Coccinelle error:
> 
> ./drivers/mtd/maps/sc520cdp.c:246:3-9: \
> 	ERROR: missing iounmap; ioremap on line 242 \
> 	and execution via conditional on line 244
> 
> Signed-off-by: Luis Henriques <henrix@...andro.org>
> ---
>  drivers/mtd/maps/sc520cdp.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/mtd/maps/sc520cdp.c b/drivers/mtd/maps/sc520cdp.c
> index 093edd51bdc7..7a27ed345d0d 100644
> --- a/drivers/mtd/maps/sc520cdp.c
> +++ b/drivers/mtd/maps/sc520cdp.c
> @@ -243,6 +243,10 @@ static int __init init_sc520cdp(void)
>  
>  		if (!sc520cdp_map[i].virt) {
>  			printk("Failed to ioremap_nocache\n");
> +			if (i) {
> +				while (--i)

Umm, so you never unmap from sc520cdp_map[0].virt? How about:

				while (--i >= 0)

?

You can also skip the 'if (i)' part in that case. Or maybe make it a for
loop, to be even clearer.

> +					iounmap(sc520cdp_map[i].virt);

This may often be a double-iounmap. If you take a look later in the
loop, many instances of the loop may not find a device, and so they'll
unmap this memory and move on. You're just doing it a second time for
them.

> +			}
>  			return -EIO;
>  		}
>  

Please put some more care into your patch, since I very much expect that
you did not test it.

Brian