linux-kernel - Re: [PATCH 5.10 14/86] dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220427202836.GA1337@duo.ucw.cz>
Date:   Wed, 27 Apr 2022 22:28:36 +0200
From:   Pavel Machek <pavel@....cz>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Zhang Qilong <zhangqilong3@...wei.com>,
        Vinod Koul <vkoul@...nel.org>, Sasha Levin <sashal@...nel.org>
Subject: Re: [PATCH 5.10 14/86] dmaengine: mediatek:Fix PM usage reference
 leak of mtk_uart_apdma_alloc_chan_resources

Hi!

> pm_runtime_get_sync will increment pm usage counter even it failed.
> Forgetting to putting operation will result in reference leak here.
> We fix it:
> 1) Replacing it with pm_runtime_resume_and_get to keep usage counter
>    balanced.

Suspect.

> 2) Add putting operation before returning error.

Yes but you also put in success case, which is likely
wrong. mtk_uart_apdma_free_chan_resources() does second put.

> +++ b/drivers/dma/mediatek/mtk-uart-apdma.c
> @@ -274,7 +274,7 @@ static int mtk_uart_apdma_alloc_chan_resources(struct dma_chan *chan)
>  	unsigned int status;
>  	int ret;
>  
> -	ret = pm_runtime_get_sync(mtkd->ddev.dev);
> +	ret = pm_runtime_resume_and_get(mtkd->ddev.dev);
>  	if (ret < 0) {
>  		pm_runtime_put_noidle(chan->device->dev);
>  		return ret;


This is suspect, too. What is the put_noidle doing there? Seems like
it was meant to undo the get_sync operation, but uses different
argument?

> @@ -288,18 +288,21 @@ static int mtk_uart_apdma_alloc_chan_resources(struct dma_chan *chan)
>  
>  	if (mtkd->support_33bits)
>  		mtk_uart_apdma_write(c, VFF_4G_SUPPORT, VFF_4G_SUPPORT_CLR_B);
>  
> +err_pm:
> +	pm_runtime_put_noidle(mtkd->ddev.dev);
>  	return ret;
>  }

This should only be done in error case.

Best regards,
								Pavel
-- 
People of Russia, stop Putin before his war on Ukraine escalates.

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)