linux-kernel - Re: [PATCH] mtd: maps: add missing iounmap() in error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87a8cq9q77.fsf@camandro.org>
Date:   Wed, 23 Nov 2016 15:22:04 +0000
From:   Luis Henriques <henrix@...andro.org>
To:     Brian Norris <computersforpeace@...il.com>
Cc:     David Woodhouse <dwmw2@...radead.org>,
        Boris Brezillon <boris.brezillon@...e-electrons.com>,
        Marek Vasut <marek.vasut@...il.com>,
        Richard Weinberger <richard@....at>,
        Cyrille Pitchen <cyrille.pitchen@...el.com>,
        linux-mtd@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mtd: maps: add missing iounmap() in error path

Brian Norris <computersforpeace@...il.com> writes:

> On Wed, Nov 16, 2016 at 10:50:16PM +0000, Luis Henriques wrote:
>> This patch was triggered by the following Coccinelle error:
>> 
>> ./drivers/mtd/maps/sc520cdp.c:246:3-9: \
>> 	ERROR: missing iounmap; ioremap on line 242 \
>> 	and execution via conditional on line 244
>> 
>> Signed-off-by: Luis Henriques <henrix@...andro.org>
>> ---
>>  drivers/mtd/maps/sc520cdp.c | 4 ++++
>>  1 file changed, 4 insertions(+)
>> 
>> diff --git a/drivers/mtd/maps/sc520cdp.c b/drivers/mtd/maps/sc520cdp.c
>> index 093edd51bdc7..7a27ed345d0d 100644
>> --- a/drivers/mtd/maps/sc520cdp.c
>> +++ b/drivers/mtd/maps/sc520cdp.c
>> @@ -243,6 +243,10 @@ static int __init init_sc520cdp(void)
>>  
>>  		if (!sc520cdp_map[i].virt) {
>>  			printk("Failed to ioremap_nocache\n");
>> +			if (i) {
>> +				while (--i)
>
> Umm, so you never unmap from sc520cdp_map[0].virt? How about:
>
> 				while (--i >= 0)
>
> ?
>
> You can also skip the 'if (i)' part in that case. Or maybe make it a for
> loop, to be even clearer.
>
>> +					iounmap(sc520cdp_map[i].virt);
>
> This may often be a double-iounmap. If you take a look later in the
> loop, many instances of the loop may not find a device, and so they'll
> unmap this memory and move on. You're just doing it a second time for
> them.
>
>> +			}
>>  			return -EIO;
>>  		}
>>  
>
> Please put some more care into your patch, since I very much expect that
> you did not test it.
>
> Brian

Thank you very much for your review.  All very good points indeed!
I'll try to send v2 soon to cover all the issues you've found.

Cheers,
-- 
Luís