linux-kernel - Re: [PATCH v2] can: sja1000: plx_pci: fix error handling path in plx_pci_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 25 Nov 2022 15:13:34 +0100
From:   Marc Kleine-Budde <mkl@...gutronix.de>
To:     Zhang Changzhong <zhangchangzhong@...wei.com>
Cc:     Wolfgang Grandegger <wg@...ndegger.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, Julia Lawall <julia@...u.dk>,
        Pavel Cheblakov <P.B.Cheblakov@....nsk.su>,
        linux-can@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] can: sja1000: plx_pci: fix error handling path in
 plx_pci_add_card()

On 25.11.2022 21:46:14, Zhang Changzhong wrote:
> If pci_iomap() or register_sja1000dev() fails, netdev will not be
> registered, but plx_pci_del_card() still deregisters the netdev.
> 
> To avoid this, let's free the netdev and clear card->net_dev[i] before
> calling plx_pci_del_card(). In addition, add the missing pci_iounmap()
> when the channel does not exist.
> 
> Compile tested only.
> 
> Fixes: 951f2f960e5b ("drivers/net/can/sja1000/plx_pci.c: eliminate double free")
> Fixes: 24c4a3b29255 ("can: add support for CAN interface cards based on the PLX90xx PCI bridge")
> Signed-off-by: Zhang Changzhong <zhangchangzhong@...wei.com>
> ---
> v1->v2: switch to goto style fix.
> 
>  drivers/net/can/sja1000/plx_pci.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
> index 5de1ebb..134a8cb 100644
> --- a/drivers/net/can/sja1000/plx_pci.c
> +++ b/drivers/net/can/sja1000/plx_pci.c
> @@ -678,7 +678,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
>  		if (!addr) {
>  			err = -ENOMEM;
>  			dev_err(&pdev->dev, "Failed to remap BAR%d\n", cm->bar);
> -			goto failure_cleanup;
> +			goto failure_free_dev;
>  		}
>  
>  		priv->reg_base = addr + cm->offset;
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> @@ -699,7 +699,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
>  			if (err) {
>  				dev_err(&pdev->dev, "Registering device failed "
>  					"(err=%d)\n", err);
> -				goto failure_cleanup;
> +				goto failure_iounmap;
>  			}
>  
>  			card->channels++;
> @@ -710,6 +710,7 @@ static int plx_pci_add_card(struct pci_dev *pdev,
>  		} else {
>  			dev_err(&pdev->dev, "Channel #%d not detected\n",
>  				i + 1);
> +			pci_iounmap(pdev, priv->reg_base);
>  			free_sja1000dev(dev);
>  			card->net_dev[i] = NULL;
>  		}
> @@ -738,6 +739,11 @@ static int plx_pci_add_card(struct pci_dev *pdev,
>  	}
>  	return 0;
>  
> +failure_iounmap:
> +	pci_iounmap(pdev, priv->reg_base);
                          ^^^^^^^^^^^^^^

reg_base it not that what has been mapped, but with an offset.

> +failure_free_dev:
> +	free_sja1000dev(dev);
> +	card->net_dev[i] = NULL;
>  failure_cleanup:
>  	dev_err(&pdev->dev, "Error: %d. Cleaning Up.\n", err);

Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde           |
Embedded Linux                   | https://www.pengutronix.de  |
Vertretung West/Dortmund         | Phone: +49-231-2826-924     |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-5555 |

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)