linux-kernel - Re: [PATCH] phy: renesas: rcar-gen2: Fix memory leak at error paths

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 27 Feb 2019 09:25:19 +0100 (CET)
From:   Julia Lawall <julia.lawall@...6.fr>
To:     Yoshihiro Shimoda <yoshihiro.shimoda.uh@...esas.com>
cc:     kishon@...com, linux-kernel@...r.kernel.org,
        linux-renesas-soc@...r.kernel.org
Subject: Re: [PATCH] phy: renesas: rcar-gen2: Fix memory leak at error
 paths



On Wed, 27 Feb 2019, Yoshihiro Shimoda wrote:

> This patch fixes memory leak at error paths of the probe function.
> In for_each_child_of_node, if the loop returns, the driver should
> call of_put_node() before returns.
>
> Reported-by: Julia Lawall <julia.lawall@...6.fr>
> Fixes: 1233f59f745 ("phy: Renesas R-Car Gen2 PHY driver")
> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@...esas.com>
> ---
>  drivers/phy/renesas/phy-rcar-gen2.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/phy/renesas/phy-rcar-gen2.c b/drivers/phy/renesas/phy-rcar-gen2.c
> index 72eeb06..570b4e4 100644
> --- a/drivers/phy/renesas/phy-rcar-gen2.c
> +++ b/drivers/phy/renesas/phy-rcar-gen2.c
> @@ -285,6 +285,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev)
>  		error = of_property_read_u32(np, "reg", &channel_num);
>  		if (error || channel_num > 2) {
>  			dev_err(dev, "Invalid \"reg\" property\n");
> +			of_node_put(np);
>  			return error;
>  		}
>  		channel->select_mask = select_mask[channel_num];
> @@ -300,6 +301,7 @@ static int rcar_gen2_phy_probe(struct platform_device *pdev)
>  						   &rcar_gen2_phy_ops);
>  			if (IS_ERR(phy->phy)) {
>  				dev_err(dev, "Failed to create PHY\n");
> +				of_node_put(np);
>  				return PTR_ERR(phy->phy);
>  			}
>  			phy_set_drvdata(phy->phy, phy);

Hello,

I was concerned about the assignment channel->of_node = np;.  Because
channels is allocated with a devm function, it will get freed on an error
return, so this pointer doesn't matter.  But don't you need an of_node_get
on this assignment?  Does the fact that you haven't seen a problem with
this in testing mean that the field is actually never accessed?

julia