| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 13 Jan 2020 13:45:10 +0300
From: Dan Carpenter <dan.carpenter@...cle.com>
To: kbuild@...ts.01.org, Sandeep Singh <Sandeep.Singh@....com>
Cc: kbuild-all@...ts.01.org, jikos@...nel.org,
benjamin.tissoires@...hat.com, linux-kernel@...r.kernel.org,
linux-input@...r.kernel.org, srinivas.pandruvada@...ux.intel.com,
jic23@...nel.org, linux-iio@...r.kernel.org,
Shyam-sundar.S-k@....com, Sandeep Singh <sandeep.singh@....com>,
Nehal Shah <Nehal-bakulchandra.Shah@....com>
Subject: Re: [PATCH 3/4] SFH: Transport Driver to add support of AMD sensor
fusion Hub (SFH)
Hi Sandeep,
url: https://github.com/0day-ci/linux/commits/Sandeep-Singh/SFH-Add-Support-for-AMD-Sensor-Fusion-Hub/20200110-084435
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git b07f636fca1c8fbba124b0082487c0b3890a0e0c
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
smatch warnings:
drivers/hid/amd-sfh-hid/amdsfh-hid-client.c:157 amd_sfh_hid_client_probe() warn: possible memory leak of 'cl_dev'
drivers/hid/amd-sfh-hid/amdsfh-hid-client.c:225 amd_sfh_hid_client_remove() warn: variable dereferenced before check 'cl_dev' (see line 218)
drivers/hid/amd-sfh-hid/amdsfh-hid-client.c:225 amd_sfh_hid_client_remove() warn: variable dereferenced before check 'cl_data' (see line 220)
drivers/hid/amd-sfh-hid/amdsfh-debugfs.c:42 amdsfh_debugfs_accel_read() warn: possible memory leak of 'obuf'
drivers/hid/amd-sfh-hid/amdsfh-debugfs.c:78 amdsfh_debugfs_gyro_read() warn: possible memory leak of 'obuf'
drivers/hid/amd-sfh-hid/amdsfh-debugfs.c:114 amdsfh_debugfs_mag_read() warn: possible memory leak of 'obuf'
drivers/hid/amd-sfh-hid/amdsfh-debugfs.c:150 amdsfh_debugfs_als_read() warn: possible memory leak of 'obuf'
# https://github.com/0day-ci/linux/commit/da2b6403065dd09f90ffdd06c25cbc139acde2b8
git remote add linux-review https://github.com/0day-ci/linux
git remote update linux-review
git checkout da2b6403065dd09f90ffdd06c25cbc139acde2b8
vim +/cl_dev +157 drivers/hid/amd-sfh-hid/amdsfh-hid-client.c
da2b6403065dd0 Sandeep Singh 2020-01-09 140 static int amd_sfh_hid_client_probe(struct platform_device *pdev)
da2b6403065dd0 Sandeep Singh 2020-01-09 141 {
da2b6403065dd0 Sandeep Singh 2020-01-09 142 struct amd_mp2_sensor_info info;
da2b6403065dd0 Sandeep Singh 2020-01-09 143 int rc = 0;
da2b6403065dd0 Sandeep Singh 2020-01-09 144 int i;
da2b6403065dd0 Sandeep Singh 2020-01-09 145 struct amdtp_cl_device *cl_dev;
da2b6403065dd0 Sandeep Singh 2020-01-09 146 struct amdtp_cl_data *cl_data;
da2b6403065dd0 Sandeep Singh 2020-01-09 147 u32 feature_report_size = 0;
da2b6403065dd0 Sandeep Singh 2020-01-09 148 u32 input_report_size = 0;
da2b6403065dd0 Sandeep Singh 2020-01-09 149
da2b6403065dd0 Sandeep Singh 2020-01-09 150 cl_dev = kzalloc(sizeof(*cl_dev), GFP_KERNEL);
da2b6403065dd0 Sandeep Singh 2020-01-09 151 if (!cl_dev)
da2b6403065dd0 Sandeep Singh 2020-01-09 152 return -ENOMEM;
da2b6403065dd0 Sandeep Singh 2020-01-09 153
da2b6403065dd0 Sandeep Singh 2020-01-09 154 cl_dev->pdev = pci_get_device(PCI_VENDOR_ID_AMD,
da2b6403065dd0 Sandeep Singh 2020-01-09 155 PCI_DEVICE_ID_AMD_MP2, NULL);
da2b6403065dd0 Sandeep Singh 2020-01-09 156 if (!cl_dev->pdev)
da2b6403065dd0 Sandeep Singh 2020-01-09 @157 return -ENOMEM;
^^^^^^^^^^^^^^
You might want to consider using devm_kzalloc().
da2b6403065dd0 Sandeep Singh 2020-01-09 158
da2b6403065dd0 Sandeep Singh 2020-01-09 159 cl_data = kzalloc(sizeof(*cl_data), GFP_KERNEL);
da2b6403065dd0 Sandeep Singh 2020-01-09 160 cl_data->num_hid_devices = amd_mp2_get_sensor_num
da2b6403065dd0 Sandeep Singh 2020-01-09 161 (cl_dev->pdev, &cl_data->sensor_idx[0]);
da2b6403065dd0 Sandeep Singh 2020-01-09 162
da2b6403065dd0 Sandeep Singh 2020-01-09 163 INIT_DELAYED_WORK(&cl_data->work, amd_sfh_work);
da2b6403065dd0 Sandeep Singh 2020-01-09 164 INIT_DELAYED_WORK(&cl_data->work_buffer, amd_sfh_work_buffer);
da2b6403065dd0 Sandeep Singh 2020-01-09 165 INIT_LIST_HEAD(&req_list.list);
da2b6403065dd0 Sandeep Singh 2020-01-09 166
da2b6403065dd0 Sandeep Singh 2020-01-09 167 amdsfh_debugfs_setup(cl_data);
da2b6403065dd0 Sandeep Singh 2020-01-09 168
da2b6403065dd0 Sandeep Singh 2020-01-09 169 for (i = 0; i < cl_data->num_hid_devices; i++) {
da2b6403065dd0 Sandeep Singh 2020-01-09 170 cl_data->sensor_virt_addr[i] = dma_alloc_coherent
da2b6403065dd0 Sandeep Singh 2020-01-09 171 (&pdev->dev, sizeof(int) * 8,
da2b6403065dd0 Sandeep Singh 2020-01-09 172 &cl_data->sensor_phy_addr[i], GFP_KERNEL);
da2b6403065dd0 Sandeep Singh 2020-01-09 173 cl_data->sensor_sts[i] = 0;
da2b6403065dd0 Sandeep Singh 2020-01-09 174 cl_data->sensor_requested_cnt[i] = 0;
da2b6403065dd0 Sandeep Singh 2020-01-09 175 cl_data->cur_hid_dev = i;
da2b6403065dd0 Sandeep Singh 2020-01-09 176
da2b6403065dd0 Sandeep Singh 2020-01-09 177 cl_data->report_descr_size[i] = get_descriptor_size
da2b6403065dd0 Sandeep Singh 2020-01-09 178 (cl_data->sensor_idx[i], descr_size);
da2b6403065dd0 Sandeep Singh 2020-01-09 179
da2b6403065dd0 Sandeep Singh 2020-01-09 180 feature_report_size = get_descriptor_size
da2b6403065dd0 Sandeep Singh 2020-01-09 181 (cl_data->sensor_idx[i], feature_size);
da2b6403065dd0 Sandeep Singh 2020-01-09 182
da2b6403065dd0 Sandeep Singh 2020-01-09 183 input_report_size = get_descriptor_size
da2b6403065dd0 Sandeep Singh 2020-01-09 184 (cl_data->sensor_idx[i], input_size);
da2b6403065dd0 Sandeep Singh 2020-01-09 185
da2b6403065dd0 Sandeep Singh 2020-01-09 186 cl_data->feature_report[i] = kzalloc(feature_report_size,
da2b6403065dd0 Sandeep Singh 2020-01-09 187 GFP_KERNEL);
da2b6403065dd0 Sandeep Singh 2020-01-09 188 cl_data->input_report[i] = kzalloc(input_report_size,
da2b6403065dd0 Sandeep Singh 2020-01-09 189 GFP_KERNEL);
da2b6403065dd0 Sandeep Singh 2020-01-09 190 info.period = PERIOD;
da2b6403065dd0 Sandeep Singh 2020-01-09 191 info.sensor_idx = cl_data->sensor_idx[i];
da2b6403065dd0 Sandeep Singh 2020-01-09 192 info.phy_address = cl_data->sensor_phy_addr[i];
da2b6403065dd0 Sandeep Singh 2020-01-09 193 cl_data->report_descr[i] = kzalloc
da2b6403065dd0 Sandeep Singh 2020-01-09 194 (cl_data->report_descr_size[i], GFP_KERNEL);
da2b6403065dd0 Sandeep Singh 2020-01-09 195 if (!cl_data->report_descr[i])
da2b6403065dd0 Sandeep Singh 2020-01-09 196 return -ENOMEM;
da2b6403065dd0 Sandeep Singh 2020-01-09 197 rc = get_report_descriptor(cl_data->sensor_idx[i],
da2b6403065dd0 Sandeep Singh 2020-01-09 198 cl_data->report_descr[i]);
da2b6403065dd0 Sandeep Singh 2020-01-09 199 rc = amdtp_hid_probe(cl_data->cur_hid_dev, cl_data);
da2b6403065dd0 Sandeep Singh 2020-01-09 200 rc = amd_start_sensor(cl_dev->pdev, info);
da2b6403065dd0 Sandeep Singh 2020-01-09 201 cl_data->sensor_sts[i] = 1;
da2b6403065dd0 Sandeep Singh 2020-01-09 202 }
da2b6403065dd0 Sandeep Singh 2020-01-09 203
da2b6403065dd0 Sandeep Singh 2020-01-09 204 cl_dev->cl_data = cl_data;
da2b6403065dd0 Sandeep Singh 2020-01-09 205 cl_data_context = cl_data;
da2b6403065dd0 Sandeep Singh 2020-01-09 206 platform_set_drvdata(pdev, cl_dev);
da2b6403065dd0 Sandeep Singh 2020-01-09 207 schedule_delayed_work(&cl_data->work_buffer, PERIOD);
da2b6403065dd0 Sandeep Singh 2020-01-09 208 return 0;
da2b6403065dd0 Sandeep Singh 2020-01-09 209 }
da2b6403065dd0 Sandeep Singh 2020-01-09 210
da2b6403065dd0 Sandeep Singh 2020-01-09 211 static int amd_sfh_hid_client_remove(struct platform_device *pdev)
da2b6403065dd0 Sandeep Singh 2020-01-09 212 {
da2b6403065dd0 Sandeep Singh 2020-01-09 213 int i;
da2b6403065dd0 Sandeep Singh 2020-01-09 214 struct amdtp_cl_device *cl_dev;
da2b6403065dd0 Sandeep Singh 2020-01-09 215 struct amdtp_cl_data *cl_data;
da2b6403065dd0 Sandeep Singh 2020-01-09 216
da2b6403065dd0 Sandeep Singh 2020-01-09 217 cl_dev = platform_get_drvdata(pdev);
da2b6403065dd0 Sandeep Singh 2020-01-09 @218 cl_data = cl_dev->cl_data;
da2b6403065dd0 Sandeep Singh 2020-01-09 219
da2b6403065dd0 Sandeep Singh 2020-01-09 @220 for (i = 0; i < cl_data->num_hid_devices; i++)
da2b6403065dd0 Sandeep Singh 2020-01-09 221 amd_stop_sensor(cl_dev->pdev, i);
da2b6403065dd0 Sandeep Singh 2020-01-09 222 cancel_delayed_work_sync(&cl_data->work);
da2b6403065dd0 Sandeep Singh 2020-01-09 223 cancel_delayed_work_sync(&cl_data->work_buffer);
da2b6403065dd0 Sandeep Singh 2020-01-09 224 amdsfh_debugfs_destroy(cl_data);
da2b6403065dd0 Sandeep Singh 2020-01-09 @225 if (cl_dev && cl_data)
^^^^^^ ^^^^^^^
If these are NULL, it's too late.
da2b6403065dd0 Sandeep Singh 2020-01-09 226 amdtp_hid_remove(cl_data);
da2b6403065dd0 Sandeep Singh 2020-01-09 227
da2b6403065dd0 Sandeep Singh 2020-01-09 228 for (i = 0; i < cl_data->num_hid_devices; i++) {
da2b6403065dd0 Sandeep Singh 2020-01-09 229 if (cl_data->sensor_virt_addr[i])
da2b6403065dd0 Sandeep Singh 2020-01-09 230 dma_free_coherent(&pdev->dev, 8 * sizeof(int),
da2b6403065dd0 Sandeep Singh 2020-01-09 231 cl_data->sensor_virt_addr[i],
da2b6403065dd0 Sandeep Singh 2020-01-09 232 cl_data->sensor_phy_addr[i]);
da2b6403065dd0 Sandeep Singh 2020-01-09 233 }
da2b6403065dd0 Sandeep Singh 2020-01-09 234
da2b6403065dd0 Sandeep Singh 2020-01-09 235 kfree(cl_data);
da2b6403065dd0 Sandeep Singh 2020-01-09 236 pr_info("%s:%s Exit\n", DRIVER_NAME, __func__);
da2b6403065dd0 Sandeep Singh 2020-01-09 237 return 0;
da2b6403065dd0 Sandeep Singh 2020-01-09 238 }
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org Intel Corporation
Powered by blists - more mailing lists