linux-kernel - [PATCH v2] drm/bochs: fix ioremap leak of mmio in bochs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20230401185544.3027703-1-gangecen@hust.edu.cn>
Date:   Sun,  2 Apr 2023 02:55:43 +0800
From:   Gencen Gan <gangecen@...t.edu.cn>
To:     Gerd Hoffmann <kraxel@...hat.com>,
        David Airlie <airlied@...il.com>,
        Daniel Vetter <daniel@...ll.ch>
Cc:     Gan Gecen <gangecen@...t.edu.cn>,
        virtualization@...ts.linux-foundation.org,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: [PATCH v2] drm/bochs: fix ioremap leak of mmio in bochs

From: Gan Gecen <gangecen@...t.edu.cn>

Smatch reports:

	drivers/gpu/drm/tiny/bochs.c:290 bochs_hw_init()
	warn: 'bochs->mmio' from ioremap() not released on
	lines: 246,250,254.

In the function bochs_load() that calls bochs_hw_init()
only, if bochs_hw_init(dev) returns -ENODEV(-19), it
will jumps to err_free_dev instead of err_hw_fini, so
bochs->mmio won't be freed.

We just need to release mmio in the corresponding error
handling.

Signed-off-by: Gan Gecen <gangecen@...t.edu.cn>
---
v1->v2: Change the strategy for fixing this
issue to manually release mmio by iounmap 
instead of changing ioremap to devm_ioremap.
 drivers/gpu/drm/tiny/bochs.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/tiny/bochs.c b/drivers/gpu/drm/tiny/bochs.c
index 024346054c70..46abed11c163 100644
--- a/drivers/gpu/drm/tiny/bochs.c
+++ b/drivers/gpu/drm/tiny/bochs.c
@@ -243,15 +243,20 @@ static int bochs_hw_init(struct drm_device *dev)
 		* 64 * 1024;
 	if ((id & 0xfff0) != VBE_DISPI_ID0) {
 		DRM_ERROR("ID mismatch\n");
+		iounmap(bochs->mmio);
 		return -ENODEV;
 	}
 
-	if ((pdev->resource[0].flags & IORESOURCE_MEM) == 0)
+	if ((pdev->resource[0].flags & IORESOURCE_MEM) == 0) {
+		iounmap(bochs->mmio);
 		return -ENODEV;
+	}
 	addr = pci_resource_start(pdev, 0);
 	size = pci_resource_len(pdev, 0);
-	if (addr == 0)
+	if (addr == 0) {
+		iounmap(bochs->mmio);
 		return -ENODEV;
+	}
 	if (size != mem) {
 		DRM_ERROR("Size mismatch: pci=%ld, bochs=%ld\n",
 			size, mem);
-- 
2.34.1