linux-kernel - Re: [PATCH] dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d1017a7a-4f3d-4218-13da-71f89cf81c81@intel.com>
Date:   Thu, 12 May 2022 10:03:48 -0700
From:   Dave Jiang <dave.jiang@...el.com>
To:     Miaoqian Lin <linmq006@...il.com>,
        Peter Ujfalusi <peter.ujfalusi@...il.com>,
        Vinod Koul <vkoul@...nel.org>, dmaengine@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] dmaengine: ti: Fix refcount leak in
 ti_dra7_xbar_route_allocate


On 5/11/2022 10:18 PM, Miaoqian Lin wrote:
> 1. of_find_device_by_node() takes reference, we should use put_device()
> to release it when not need anymore.
> 2. of_parse_phandle() returns a node pointer with refcount
> incremented, we should use of_node_put() on it when not needed anymore.
>
> Add put_device() and of_node_put() in some error paths to fix.
Sounds like you need 2 patches for this? One just for the put_device() 
and the other for the of_node_put()?
>
> Fixes: ec9bfa1e1a79 ("dmaengine: ti-dma-crossbar: dra7: Use bitops instead of idr")
> Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x")
> Signed-off-by: Miaoqian Lin <linmq006@...il.com>
> ---
>   drivers/dma/ti/dma-crossbar.c | 5 +++++
>   1 file changed, 5 insertions(+)
>
> diff --git a/drivers/dma/ti/dma-crossbar.c b/drivers/dma/ti/dma-crossbar.c
> index 71d24fc07c00..f744ddbbbad7 100644
> --- a/drivers/dma/ti/dma-crossbar.c
> +++ b/drivers/dma/ti/dma-crossbar.c
> @@ -245,6 +245,7 @@ static void *ti_dra7_xbar_route_allocate(struct of_phandle_args *dma_spec,
>   	if (dma_spec->args[0] >= xbar->xbar_requests) {
>   		dev_err(&pdev->dev, "Invalid XBAR request number: %d\n",
>   			dma_spec->args[0]);
> +		put_device(&pdev->dev);
>   		return ERR_PTR(-EINVAL);
>   	}
>   
> @@ -252,12 +253,14 @@ static void *ti_dra7_xbar_route_allocate(struct of_phandle_args *dma_spec,
>   	dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", 0);
>   	if (!dma_spec->np) {
>   		dev_err(&pdev->dev, "Can't get DMA master\n");
> +		put_device(&pdev->dev);
>   		return ERR_PTR(-EINVAL);
>   	}
>   
>   	map = kzalloc(sizeof(*map), GFP_KERNEL);
>   	if (!map) {
>   		of_node_put(dma_spec->np);
> +		put_device(&pdev->dev);
>   		return ERR_PTR(-ENOMEM);
>   	}
>   
> @@ -268,6 +271,8 @@ static void *ti_dra7_xbar_route_allocate(struct of_phandle_args *dma_spec,
>   		mutex_unlock(&xbar->mutex);
>   		dev_err(&pdev->dev, "Run out of free DMA requests\n");
>   		kfree(map);
> +		of_node_put(dma_spec->np);
> +		put_device(&pdev->dev);
>   		return ERR_PTR(-ENOMEM);
>   	}
>   	set_bit(map->xbar_out, xbar->dma_inuse);