linux-kernel - Re: [PATCH] powerpc: platforms: 52xx: Fix a resource leak in an error handling path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220201064437.GP1951@kadam>
Date:   Tue, 1 Feb 2022 09:44:37 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Christophe JAILLET <christophe.jaillet@...adoo.fr>
Cc:     Anatolij Gustschin <agust@...x.de>,
        Michael Ellerman <mpe@...erman.id.au>,
        Benjamin Herrenschmidt <benh@...nel.crashing.org>,
        Paul Mackerras <paulus@...ba.org>,
        Grant Likely <grant.likely@...retlab.ca>,
        John Bonesio <bones@...retlab.ca>,
        linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org,
        linuxppc-dev@...ts.ozlabs.org
Subject: Re: [PATCH] powerpc: platforms: 52xx: Fix a resource leak in an
 error handling path

On Sat, Jan 29, 2022 at 08:16:04AM +0100, Christophe JAILLET wrote:
> The error handling path of mpc52xx_lpbfifo_probe() and a request_irq() is
> not balanced by a corresponding free_irq().
> 
> Add the missing call, as already done in the remove function.
> 
> Fixes: 3c9059d79f5e ("powerpc/5200: add LocalPlus bus FIFO device driver")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
> ---
> Another strange thing is that the remove function has:
> 	/* Release the bestcomm transmit task */
> 	free_irq(bcom_get_task_irq(lpbfifo.bcom_tx_task), &lpbfifo);
> but I've not been able to find a corresponding request_irq().
> 
> Is it dead code? Is there something missing in the probe?
> (...Is it working?...)

I think you're right that the tx_task IRQ is never allocated.

I'm pretty sure that if you free a zero IRQ then it's a no-op.  It won't
find the 0 in the radix tree so irq_to_desc() returns NULL and free_irq()
returns early.

regards,
dan carpenter