linux-kernel - [PING PATCH] drm/pl111: fix drm and dev leak when irq request failed.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20230416080907.3895808-1-gangecen@hust.edu.cn>
Date:   Sun, 16 Apr 2023 16:09:07 +0800
From:   Gencen Gan <gangecen@...t.edu.cn>
To:     Emma Anholt <emma@...olt.net>, David Airlie <airlied@...il.com>,
        Daniel Vetter <daniel@...ll.ch>,
        Gan Gecen <gangecen@...t.edu.cn>
Cc:     hust-os-kernel-patches@...glegroups.com,
        Cheng Ziqiu <chengziqiu@...t.edu.cn>,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: [PING PATCH] drm/pl111: fix drm and dev leak when irq request failed.

Smatch reports:
	pl111_amba_probe() warn: missing unwind goto?

Code segment for dev_put is:
	dev_put:
		drm_dev_put(drm);
		of_reserved_mem_device_release(dev);

When err happened, jumping to dev_put will release
drm and dev resources allocated or initialized 
before. But after devm_request_irq() failed, it
returns directly without releasing drm and dev, 
which may cause memory leak.

Fixes: 3f9d6bccff6c ("drm/pl111: fix drm and dev leak when irq request failed")
Signed-off-by: Gan Gecen <gangecen@...t.edu.cn>
Reviewed-by: Cheng Ziqiu <chengziqiu@...t.edu.cn>
---
 drivers/gpu/drm/pl111/pl111_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/pl111/pl111_drv.c b/drivers/gpu/drm/pl111/pl111_drv.c
index 00deba0b7271..52945f7e0aef 100644
--- a/drivers/gpu/drm/pl111/pl111_drv.c
+++ b/drivers/gpu/drm/pl111/pl111_drv.c
@@ -297,7 +297,7 @@ static int pl111_amba_probe(struct amba_device *amba_dev,
 			       variant->name, priv);
 	if (ret != 0) {
 		dev_err(dev, "%s failed irq %d\n", __func__, ret);
-		return ret;
+		goto dev_put;
 	}
 
 	ret = pl111_modeset_init(drm);
-- 
2.34.1