linux-kernel - Re: [PATCH] mmc: wmt-sdmmc: Fix an error handling path in wmt_mci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 8 Mar 2022 15:54:45 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Christophe JAILLET <christophe.jaillet@...adoo.fr>
Cc:     ulf.hansson@...aro.org, cjb@...top.org, linux-mmc@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] mmc: wmt-sdmmc: Fix an error handling path in
 wmt_mci_probe()

On Sun, Mar 06, 2022 at 06:44:56PM +0100, Christophe JAILLET wrote:
> A dma_free_coherent() call is missing in the error handling path of the
> probe, as already done in the remove function.
> 
> Fixes: 3a96dff0f828 ("mmc: SD/MMC Host Controller for Wondermedia WM8505/WM8650")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
> ---
> I've not been able to find a Fixes tag because of the renaming of
> function and files.
> However, it looks old (before 2008)

You did add a fixes tag and it's from 2012.  :P

> ---
>  drivers/mmc/host/wmt-sdmmc.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c
> index 163ac9df8cca..8e18f01c0938 100644
> --- a/drivers/mmc/host/wmt-sdmmc.c
> +++ b/drivers/mmc/host/wmt-sdmmc.c
> @@ -863,6 +863,8 @@ static int wmt_mci_probe(struct platform_device *pdev)
>  	return 0;
>  fail6:
>  	clk_put(priv->clk_sdmmc);
> +	dma_free_coherent(&pdev->dev, mmc->max_blk_count * 16,
> +			  priv->dma_desc_buffer, priv->dma_desc_device_addr);
>  fail5:
>  	free_irq(dma_irq, priv);

This isn't quite right.  If of_clk_get() fails it should call
dma_free_coherent() but it does not.  You need to add:

 fail6:
 	clk_put(priv->clk_sdmmc);
+fail5_and_a_half:
+	dma_free_coherent(&pdev->dev, mmc->max_blk_count * 16,
+			  priv->dma_desc_buffer, priv->dma_desc_device_addr);
 fail5:
 	free_irq(dma_irq, priv);

regards,
dan carpenter