linux-kernel - Re: [PATCH] arm64: PCI: free all allocated memory in case of failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 May 2017 20:32:09 +0800
From:   Timmy Li <lixiaoping3@...wei.com>
To:     Lorenzo Pieralisi <lorenzo.pieralisi@....com>
CC:     <bhelgaas@...gle.com>, <tn@...ihalf.com>,
        <linux-kernel@...r.kernel.org>, <linux-pci@...r.kernel.org>,
        <linuxarm@...wei.com>, <gabriele.paoloni@...wei.com>
Subject: Re: [PATCH] arm64: PCI: free all allocated memory in case of failure

Hi Lorenzo,

Thanks for your review and sorry for the late reply.

On 2017/5/12 18:28, Lorenzo Pieralisi wrote:
> On Fri, May 12, 2017 at 05:57:47PM +0800, Timmy Li wrote:
>> There are some memory allocations in pci_acpi_scan_root(). But
>> ri, root_ops and ri->cfg are not freed properly in failure cases,
>> which results in memory leaks. This patch fixes the potential
>> memory leaks.
>>
>> Signed-off-by: Timmy Li <lixiaoping3@...wei.com>
>> ---
>>  arch/arm64/kernel/pci.c | 22 ++++++++++++++--------
>>  1 file changed, 14 insertions(+), 8 deletions(-)
>>
>> diff --git a/arch/arm64/kernel/pci.c b/arch/arm64/kernel/pci.c
>> index 4f0e3eb..e7e88ce 100644
>> --- a/arch/arm64/kernel/pci.c
>> +++ b/arch/arm64/kernel/pci.c
>> @@ -188,25 +188,22 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
>>  
>>  	ri = kzalloc_node(sizeof(*ri), GFP_KERNEL, node);
>>  	if (!ri)
>> -		return NULL;
>> +		goto err_allocri;
>>  
>>  	root_ops = kzalloc_node(sizeof(*root_ops), GFP_KERNEL, node);
>>  	if (!root_ops)
>> -		return NULL;
>> +		goto err_allocops;

I think it is still needed to free ri here When ri is allocated successfully and root_ops is not. Considering this is the only remain place that need to fix, a simple way to do this would be:
if (!root_ops) {
+	kfree(ri);
	return NULL;
}

>>  
>>  	ri->cfg = pci_acpi_setup_ecam_mapping(root);
>> -	if (!ri->cfg) {
>> -		kfree(ri);
>> -		kfree(root_ops);
>> -		return NULL;
>> -	}
>> +	if (!ri->cfg)
>> +		goto err_ecam;
>>  
>>  	root_ops->release_info = pci_acpi_generic_release_info;
> 
> You are missing this ^^^^^^^^^
> 
>>  	root_ops->prepare_resources = pci_acpi_root_prepare_resources;
>>  	root_ops->pci_ops = &ri->cfg->ops->pci_ops;
>>  	bus = acpi_pci_root_create(root, root_ops, &ri->common, ri->cfg);
>>  	if (!bus)
> 
> And how it works if (bus == NULL) here.

You are correct. There is no need to do anything When acpi_pci_root_create() fails.

> 
> Lorenzo
> 
>> -		return NULL;
>> +		goto err_rootcreate;
>>  
>>  	pci_bus_size_bridges(bus);
>>  	pci_bus_assign_resources(bus);
>> @@ -215,6 +212,15 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
>>  		pcie_bus_configure_settings(child);
>>  
>>  	return bus;
>> +
>> +err_rootcreate:
>> +	pci_ecam_free(ri->cfg);
>> +err_ecam:
>> +	kfree(root_ops);
>> +err_allocops:
>> +	kfree(ri);
>> +err_allocri:
>> +	return NULL;
>>  }
>>  
>>  void pcibios_add_bus(struct pci_bus *bus)
>> -- 
>> 1.9.1
>>
>>
> 
> .
>