linux-kernel - Re: [PATCH 3/7] drm/msm: a5xx: fix possible object reference leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190410162140.GA9296@jcrouse1-lnx.qualcomm.com>
Date:   Wed, 10 Apr 2019 10:21:40 -0600
From:   Jordan Crouse <jcrouse@...eaurora.org>
To:     Wen Yang <wen.yang99@....com.cn>
Cc:     linux-kernel@...r.kernel.org, wang.yi59@....com.cn,
        Rob Clark <robdclark@...il.com>, Sean Paul <sean@...rly.run>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        Mamta Shukla <mamtashukla555@...il.com>,
        Thomas Zimmermann <tzimmermann@...e.de>,
        Sharat Masetty <smasetty@...eaurora.org>,
        linux-arm-msm@...r.kernel.org, dri-devel@...ts.freedesktop.org,
        freedreno@...ts.freedesktop.org
Subject: Re: [PATCH 3/7] drm/msm: a5xx: fix possible object reference leak

On Thu, Apr 04, 2019 at 12:04:11AM +0800, Wen Yang wrote:
> The call to of_get_child_by_name returns a node pointer with refcount
> incremented thus it must be explicitly decremented after the last
> usage.
> 
> Detected by coccinelle with the following warnings:
> drivers/gpu/drm/msm/adreno/a5xx_gpu.c:57:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 47, but without a corresponding object release within this function.
> drivers/gpu/drm/msm/adreno/a5xx_gpu.c:66:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 47, but without a corresponding object release within this function.
> drivers/gpu/drm/msm/adreno/a5xx_gpu.c:118:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 47, but without a corresponding object release within this function.
> drivers/gpu/drm/msm/adreno/a5xx_gpu.c:57:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 51, but without a corresponding object release within this function.
> drivers/gpu/drm/msm/adreno/a5xx_gpu.c:66:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 51, but without a corresponding object release within this function.
> drivers/gpu/drm/msm/adreno/a5xx_gpu.c:118:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 51, but without a corresponding object release within this function.
> 
> Signed-off-by: Wen Yang <wen.yang99@....com.cn>
> Cc: Rob Clark <robdclark@...il.com>
> Cc: Sean Paul <sean@...rly.run>
> Cc: David Airlie <airlied@...ux.ie>
> Cc: Daniel Vetter <daniel@...ll.ch>
> Cc: Jordan Crouse <jcrouse@...eaurora.org>
> Cc: Mamta Shukla <mamtashukla555@...il.com>
> Cc: Thomas Zimmermann <tzimmermann@...e.de>
> Cc: Sharat Masetty <smasetty@...eaurora.org>
> Cc: linux-arm-msm@...r.kernel.org
> Cc: dri-devel@...ts.freedesktop.org
> Cc: freedreno@...ts.freedesktop.org
> Cc: linux-kernel@...r.kernel.org (open list)


Sorry for the delay. This looks right to me and possibly appropriate for stable
as well.

Reviewed-by: Jordan Crouse <jcrouse@...eaurora.org>

> ---
>  drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
> index d5f5e56..270da14 100644
> --- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
> +++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
> @@ -34,7 +34,7 @@ static int zap_shader_load_mdt(struct msm_gpu *gpu, const char *fwname)
>  {
>  	struct device *dev = &gpu->pdev->dev;
>  	const struct firmware *fw;
> -	struct device_node *np;
> +	struct device_node *np, *mem_np;
>  	struct resource r;
>  	phys_addr_t mem_phys;
>  	ssize_t mem_size;
> @@ -48,11 +48,13 @@ static int zap_shader_load_mdt(struct msm_gpu *gpu, const char *fwname)
>  	if (!np)
>  		return -ENODEV;
>  
> -	np = of_parse_phandle(np, "memory-region", 0);
> -	if (!np)
> +	mem_np = of_parse_phandle(np, "memory-region", 0);
> +	of_node_put(np);
> +	if (!mem_np)
>  		return -EINVAL;
>  
> -	ret = of_address_to_resource(np, 0, &r);
> +	ret = of_address_to_resource(mem_np, 0, &r);
> +	of_node_put(mem_np);
>  	if (ret)
>  		return ret;
>  
> -- 
> 2.9.5
> 

-- 
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project