linux-kernel - [PATCH v1] parisc : eisa :- Prevent resource leake and NULL error in error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 18 Jan 2017 13:41:31 +0530
From:   Arvind Yadav <arvind.yadav.cs@...il.com>
To:     jejb@...isc-linux.org, deller@....de
Cc:     linux-parisc@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH v1] parisc : eisa :- Prevent resource leake and NULL error in error path

Here, If ioremap_nocache will fail. It will return NULL.
Kernel can run into a NULL-pointer dereference.

If eisa_probe will fail, Handle ERROR properly.
 -Release resource
 -Free irq line.
 -Unmap I/O memory from kernel address space.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@...il.com>
---
 drivers/parisc/eisa.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/parisc/eisa.c b/drivers/parisc/eisa.c
index 103095b..2c7f90f 100644
--- a/drivers/parisc/eisa.c
+++ b/drivers/parisc/eisa.c
@@ -334,7 +334,7 @@ static int __init eisa_probe(struct parisc_device *dev)
 	result = request_irq(dev->irq, eisa_irq, IRQF_SHARED, "EISA", &eisa_dev);
 	if (result) {
 		printk(KERN_ERR "EISA: request_irq failed!\n");
-		return result;
+		goto error_release;
 	}
 	
 	/* Reserve IRQ2 */
@@ -358,6 +358,11 @@ static int __init eisa_probe(struct parisc_device *dev)
 		}
 	}
 	eisa_eeprom_addr = ioremap_nocache(eisa_dev.eeprom_addr, HPEE_MAX_LENGTH);
+	if (!eisa_eeprom_addr) {
+		result = -ENOMEM;
+		printk(KERN_ERR "EISA: ioremap_nocache failed!\n");
+		goto error_free_irq;
+	}
 	result = eisa_enumerator(eisa_dev.eeprom_addr, &eisa_dev.hba.io_space,
 			&eisa_dev.hba.lmmio_space);
 	init_eisa_pic();
@@ -371,12 +376,21 @@ static int __init eisa_probe(struct parisc_device *dev)
 		eisa_dev.root.slots = result;
 		eisa_dev.root.dma_mask = 0xffffffff; /* wild guess */
 		if (eisa_root_register (&eisa_dev.root)) {
+			result = -ENOMEM;
 			printk(KERN_ERR "EISA: Failed to register EISA root\n");
-			return -1;
+			goto error_iounmap;
 		}
 	}
 	
 	return 0;
+
+error_iounmap:
+	iounmap(eisa_eeprom_addr);
+error_free_irq:
+	free_irq(dev->irq, &eisa_dev);
+error_release:
+	release_resource(&eisa_dev.hba.io_space);
+	return result;
 }
 
 static const struct parisc_device_id eisa_tbl[] = {
-- 
1.9.1