linux-kernel - Re: [PATCH] PCI: Fix memory leak in pci_register_io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 17 Feb 2021 17:32:16 -0600
From:   Bjorn Helgaas <helgaas@...nel.org>
To:     Geert Uytterhoeven <geert+renesas@...der.be>
Cc:     Bjorn Helgaas <bhelgaas@...gle.com>,
        John Garry <john.garry@...wei.com>,
        Arnd Bergmann <arnd@...db.de>, linux-pci@...r.kernel.org,
        linux-renesas-soc@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] PCI: Fix memory leak in pci_register_io_range()

On Tue, Feb 02, 2021 at 11:03:32AM +0100, Geert Uytterhoeven wrote:
> Kmemleak reports:
> 
>     unreferenced object 0xc328de40 (size 64):
>       comm "kworker/1:1", pid 21, jiffies 4294938212 (age 1484.670s)
>       hex dump (first 32 bytes):
>         00 00 00 00 00 00 00 00 e0 d8 fc eb 00 00 00 00  ................
>         00 00 10 fe 00 00 00 00 00 00 00 00 00 00 00 00  ................
> 
>     backtrace:
>       [<ad758d10>] pci_register_io_range+0x3c/0x80
>       [<2c7f139e>] of_pci_range_to_resource+0x48/0xc0
>       [<f079ecc8>] devm_of_pci_get_host_bridge_resources.constprop.0+0x2ac/0x3ac
>       [<e999753b>] devm_of_pci_bridge_init+0x60/0x1b8
>       [<a895b229>] devm_pci_alloc_host_bridge+0x54/0x64
>       [<e451ddb0>] rcar_pcie_probe+0x2c/0x644
> 
> In case a PCI host driver's probe is deferred, the same I/O range may be
> allocated again, and be ignored, causing a memory leak.
> 
> Fix this by (a) letting logic_pio_register_range() return -EEXIST if the
> passed range already exists, so pci_register_io_range() will free it,
> and by (b) making pci_register_io_range() not consider -EEXIST an error
> condition.
> 
> Signed-off-by: Geert Uytterhoeven <geert+renesas@...der.be>

Applied to pci/enumeration for v5.12, thanks!

> ---
>  drivers/pci/pci.c | 4 ++++
>  lib/logic_pio.c   | 3 +++
>  2 files changed, 7 insertions(+)
> 
> diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
> index 09b03cfba8894955..c651003e304a2b71 100644
> --- a/drivers/pci/pci.c
> +++ b/drivers/pci/pci.c
> @@ -4037,6 +4037,10 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr,
>  	ret = logic_pio_register_range(range);
>  	if (ret)
>  		kfree(range);
> +
> +	/* Ignore duplicates due to deferred probing */
> +	if (ret == -EEXIST)
> +		ret = 0;
>  #endif
>  
>  	return ret;
> diff --git a/lib/logic_pio.c b/lib/logic_pio.c
> index f32fe481b4922bc1..07b4b9a1f54b6bf5 100644
> --- a/lib/logic_pio.c
> +++ b/lib/logic_pio.c
> @@ -28,6 +28,8 @@ static DEFINE_MUTEX(io_range_mutex);
>   * @new_range: pointer to the IO range to be registered.
>   *
>   * Returns 0 on success, the error code in case of failure.
> + * If the range already exists, -EEXIST will be returned, which should be
> + * considered a success.
>   *
>   * Register a new IO range node in the IO range list.
>   */
> @@ -51,6 +53,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
>  	list_for_each_entry(range, &io_range_list, list) {
>  		if (range->fwnode == new_range->fwnode) {
>  			/* range already there */
> +			ret = -EEXIST;
>  			goto end_register;
>  		}
>  		if (range->flags == LOGIC_PIO_CPU_MMIO &&
> -- 
> 2.25.1
>