linux-kernel - Re: [PATCH] scsi: sni_53c710: Fix a resource leak in an error handling path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 May 2021 06:57:44 +0200
From:   Christophe JAILLET <christophe.jaillet@...adoo.fr>
To:     jejb@...ux.ibm.com, martin.petersen@...cle.com,
        James.Bottomley@...elEye.com
Cc:     linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] scsi: sni_53c710: Fix a resource leak in an error
 handling path

Le 20/05/2021 à 06:44, Christophe JAILLET a écrit :
> After a successful 'NCR_700_detect()' call, 'NCR_700_release()' must be
> called to release some DMA related resources, as already done in the
> remove function.
> 
> Fixes: c27d85f3f3c5 ("[SCSI] SNI RM 53c710 driver")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
> ---
>   drivers/scsi/sni_53c710.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c
> index 678651b9b4dd..f6d60d542207 100644
> --- a/drivers/scsi/sni_53c710.c
> +++ b/drivers/scsi/sni_53c710.c
> @@ -98,6 +98,7 @@ static int snirm710_probe(struct platform_device *dev)
>   
>    out_put_host:
>   	scsi_host_put(host);
> +	NCR_700_release(host);
>    out_kfree:
>   	iounmap(hostdata->base);
>   	kfree(hostdata);
> 
Hi,

please note that this patch is speculative
All the drivers I've look at don't call NCR_700_release in the error 
handling path of the probe. They only do in the remove function.
So it is likely that this patch is wrong and that the truth is elsewhere.

'scsi_host_put()' is used in the probe and 'scsi_remove_host()' in the 
remove function. That maybe is the trick, but I've not been able to see 
how NCR_700_release (or equivalent) was called in this case.

So review with care!

CJ