linux-kernel - Re: [PATCH 2/3] dmaengine: usb-dmac: Fix PM reference leak in usb_dmac

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 31 May 2021 11:19:11 +0200
From:   Johan Hovold <johan@...nel.org>
To:     Vinod Koul <vkoul@...nel.org>
Cc:     "yukuai (C)" <yukuai3@...wei.com>, mcoquelin.stm32@...il.com,
        alexandre.torgue@...s.st.com, michal.simek@...inx.com,
        dmaengine@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-stm32@...md-mailman.stormreply.com,
        linux-arm-kernel@...ts.infradead.org, yi.zhang@...wei.com
Subject: Re: [PATCH 2/3] dmaengine: usb-dmac: Fix PM reference leak in
 usb_dmac_probe()

On Mon, May 31, 2021 at 02:27:34PM +0530, Vinod Koul wrote:
> On 31-05-21, 14:11, yukuai (C) wrote:
> > On 2021/05/31 12:00, Vinod Koul wrote:
> > > On 17-05-21, 16:18, Yu Kuai wrote:
> > > > pm_runtime_get_sync will increment pm usage counter even it failed.
> > > > Forgetting to putting operation will result in reference leak here.
> > > > Fix it by replacing it with pm_runtime_resume_and_get to keep usage
> > > > counter balanced.
> > > > 
> > > > Reported-by: Hulk Robot <hulkci@...wei.com>
> > > > Signed-off-by: Yu Kuai <yukuai3@...wei.com>
> > > > ---
> > > >   drivers/dma/sh/usb-dmac.c | 2 +-
> > > >   1 file changed, 1 insertion(+), 1 deletion(-)
> > > > 
> > > > diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
> > > > index 8f7ceb698226..2a6c8fd8854e 100644
> > > > --- a/drivers/dma/sh/usb-dmac.c
> > > > +++ b/drivers/dma/sh/usb-dmac.c
> > > > @@ -796,7 +796,7 @@ static int usb_dmac_probe(struct platform_device *pdev)
> > > >   	/* Enable runtime PM and initialize the device. */
> > > >   	pm_runtime_enable(&pdev->dev);
> > > > -	ret = pm_runtime_get_sync(&pdev->dev);
> > > > +	ret = pm_runtime_resume_and_get(&pdev->dev);
> > > 
> > > This does not seem to fix anything.. the below goto goes and disables
> > > the runtime_pm for this device and thus there wont be any leak
> > Hi,
> > 
> > If pm_runtime_get_sync() fails and increments the pm.usage_count
> > variable, pm_runtime_disable() does not reset the counter, and
> > we still need to decrement the usage count when pm_runtime_get_sync()
> > fails. Do I miss anthing?
> 
> Yes the rumtime_pm is disabled on failure here and the count would have
> no consequence...

You should still balance the PM usage counter as it isn't reset for
example when reloading the driver.

Using pm_runtime_resume_and_get() is one way of handling this, but
alternatively you could also move the error_pm label above the
pm_runtime_put() in the error path.

Johan