linux-kernel - RE: [PATCH rc v2] genirq/msi: Free the fwnode created by msi_create_device_irq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <BN9PR11MB527661A8F2B8CF80F03CD13C8CC79@BN9PR11MB5276.namprd11.prod.outlook.com>
Date:   Wed, 18 Jan 2023 01:24:06 +0000
From:   "Tian, Kevin" <kevin.tian@...el.com>
To:     Jason Gunthorpe <jgg@...dia.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>
CC:     Kalle Valo <kvalo@...nel.org>, Leon Romanovsky <leonro@...dia.com>,
        "Marc Zyngier" <maz@...nel.org>, Omri Barazi <obarazi@...dia.com>
Subject: RE: [PATCH rc v2] genirq/msi: Free the fwnode created by
 msi_create_device_irq_domain()

> From: Jason Gunthorpe <jgg@...dia.com>
> Sent: Wednesday, January 18, 2023 3:16 AM
> 
> msi_create_device_irq_domain creates a fwnode for the new domain, but it
> is never freed. kmemleak reports:
> 
> unreferenced object 0xffff888120ba9a00 (size 96):
>   comm "systemd-modules", pid 221, jiffies 4294893411 (age 635.732s)
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 e0 19 8b 83 ff ff ff ff  ................
>     00 00 00 00 00 00 00 00 18 9a ba 20 81 88 ff ff  ........... ....
>   backtrace:
>     [<00000000bcb7f3b1>] kmalloc_trace+0x27/0x110
>     [<000000008cdbc98d>] __irq_domain_alloc_fwnode+0x51/0x2b0
>     [<00000000c57acf9d>] msi_create_device_irq_domain+0x283/0x670
>     [<000000009b567982>] __pci_enable_msix_range+0x49e/0xdb0
>     [<0000000077cc1445>] pci_alloc_irq_vectors_affinity+0x11f/0x1c0
>     [<00000000532e9ef5>] mlx5_irq_table_create+0x24c/0x940 [mlx5_core]
>     [<00000000fabd2b80>] mlx5_load+0x1fa/0x680 [mlx5_core]
>     [<000000006bb22ae4>] mlx5_init_one+0x485/0x670 [mlx5_core]
>     [<00000000eaa5e1ad>] probe_one+0x4c2/0x720 [mlx5_core]
>     [<00000000df8efb43>] local_pci_probe+0xd6/0x170
>     [<0000000085cb9924>] pci_device_probe+0x231/0x6e0
>     [<000000002671d86e>] really_probe+0x1cf/0xaa0
>     [<000000002aeba218>] __driver_probe_device+0x18f/0x470
>     [<000000002aec9527>] driver_probe_device+0x49/0x120
>     [<000000005f45a989>] __driver_attach+0x1ff/0x4a0
>     [<0000000000dcaab2>] bus_for_each_dev+0x11e/0x1a0
> 
> Use the proper free operation for the fwnode so the name is freed during
> error unwind of msi_create_device_irq_domain() and free the fwnode in
> msi_remove_device_irq_domain() if it was automatically allocated.
> 
> Make irq_domain_free_fwnode() tolerant of NULL.
> 
> Fixes: 27a6dea3ebaa ("genirq/msi: Provide
> msi_create/free_device_irq_domain()")
> Reported-by: Omri Barazi <obarazi@...dia.com>
> Tested-by: Kalle Valo <kvalo@...nel.org>
> Tested-by: Leon Romanovsky <leonro@...dia.com>
> Signed-off-by: Jason Gunthorpe <jgg@...dia.com>

Reviewed-by: Kevin Tian <kevin.tian@...el.com>