linux-kernel - Re: [PATCH] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 15 Dec 2020 22:35:45 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Maxime Ripard <maxime@...no.tech>
Cc:     Christophe JAILLET <christophe.jaillet@...adoo.fr>,
        davem@...emloft.net, kuba@...nel.org, wens@...e.org,
        jernej.skrabec@...l.net, timur@...nel.org,
        song.bao.hua@...ilicon.com, f.fainelli@...il.com, leon@...nel.org,
        hkallweit1@...il.com, wangyunjian@...wei.com, sr@...x.de,
        linux-arm-kernel@...ts.infradead.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] net: allwinner: Fix some resources leak in the error
 handling path of the probe and in the remove function

On Tue, Dec 15, 2020 at 08:08:15PM +0100, Maxime Ripard wrote:
> On Tue, Dec 15, 2020 at 07:18:48PM +0100, Christophe JAILLET wrote:
> > Le 15/12/2020 à 12:37, Maxime Ripard a écrit :
> > > On Tue, Dec 15, 2020 at 12:11:53PM +0300, Dan Carpenter wrote:
> > > > On Tue, Dec 15, 2020 at 09:56:55AM +0100, Maxime Ripard wrote:
> > > > > Hi,
> > > > > 
> > > > > On Mon, Dec 14, 2020 at 09:21:17PM +0100, Christophe JAILLET wrote:
> > > > > > 'irq_of_parse_and_map()' should be balanced by a corresponding
> > > > > > 'irq_dispose_mapping()' call. Otherwise, there is some resources leaks.
> > > > > 
> > > > > Do you have a source to back that? It's not clear at all from the
> > > > > documentation for those functions, and couldn't find any user calling it
> > > > > from the ten-or-so random picks I took.
> > > > 
> > > > It looks like irq_create_of_mapping() needs to be freed with
> > > > irq_dispose_mapping() so this is correct.
> > > 
> > > The doc should be updated first to make that clear then, otherwise we're
> > > going to fix one user while multiples will have poped up
> > > 
> > > Maxime
> > > 
> > 
> > Hi,
> > 
> > as Dan explained, I think that 'irq_dispose_mapping()' is needed because of
> > the 'irq_create_of_mapping()" within 'irq_of_parse_and_map()'.
> > 
> > As you suggest, I'll propose a doc update to make it clear and more future
> > proof.
> 
> Thanks :)
> 
> And if you feel like it, a coccinelle script would be awesome too so
> that other users get fixed over time
> 
> Maxime

Smatch has a new check for resource leaks which hopefully people will
find useful.

https://github.com/error27/smatch/blob/master/check_unwind.c

To check for these I would need to add the following lines to the table:

        { "irq_of_parse_and_map", ALLOC, -1, "$", &int_one, &int_max},
        { "irq_create_of_mapping", ALLOC, -1, "$", &int_one, &int_max},
        { "irq_dispose_mapping", RELEASE, 0, "$"},

The '-1, "$"' means the returned value.  irq_of_parse_and_map() and
irq_create_of_mapping() return positive int on success.

The irq_dispose_mapping() frees its zeroth parameter so it's listed as
'0, "$"'.  We don't care about the returns from irq_dispose_mapping().

It doesn't apply in this case but if a function frees a struct member
then that's listed as '0, "$->member_name"'.

regards,
dan carpenter