linux-kernel - Re: [PATCH] media: intel/ipu6: Fix an error handling path in isys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 20 May 2024 10:47:20 +0000
From: Sakari Ailus <sakari.ailus@...ux.intel.com>
To: Christophe JAILLET <christophe.jaillet@...adoo.fr>
Cc: Bingbu Cao <bingbu.cao@...el.com>, Tianshu Qiu <tian.shu.qiu@...el.com>,
	Mauro Carvalho Chehab <mchehab@...nel.org>,
	Hans de Goede <hdegoede@...hat.com>,
	Hans Verkuil <hverkuil-cisco@...all.nl>,
	linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org,
	linux-media@...r.kernel.org
Subject: Re: [PATCH] media: intel/ipu6: Fix an error handling path in
 isys_probe()

Hi Christophe,

Thanks for the patch.

On Mon, May 20, 2024 at 12:32:30PM +0200, Christophe JAILLET wrote:
> If an error occurs after a successful alloc_fw_msg_bufs() call, some
> resources should be released as already done in the remove function.
> 
> Fixes: f50c4ca0a820 ("media: intel/ipu6: add the main input system driver")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
> ---
> Compile tested only
> ---
>  drivers/media/pci/intel/ipu6/ipu6-isys.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys.c b/drivers/media/pci/intel/ipu6/ipu6-isys.c
> index 5992138c7290..d9e1e1a135b9 100644
> --- a/drivers/media/pci/intel/ipu6/ipu6-isys.c
> +++ b/drivers/media/pci/intel/ipu6/ipu6-isys.c
> @@ -1062,6 +1062,7 @@ static int isys_probe(struct auxiliary_device *auxdev,
>  	const struct ipu6_isys_internal_csi2_pdata *csi2_pdata;
>  	struct ipu6_bus_device *adev = auxdev_to_adev(auxdev);
>  	struct ipu6_device *isp = adev->isp;
> +	struct isys_fw_msgs *fwmsg, *safe;
>  	const struct firmware *fw;
>  	struct ipu6_isys *isys;
>  	unsigned int i;
> @@ -1140,12 +1141,17 @@ static int isys_probe(struct auxiliary_device *auxdev,
>  
>  	ret = isys_register_devices(isys);
>  	if (ret)
> -		goto out_remove_pkg_dir_shared_buffer;
> +		goto free_fw_msg_bufs;
>  
>  	ipu6_mmu_hw_cleanup(adev->mmu);
>  
>  	return 0;
>  
> +free_fw_msg_bufs:
> +	list_for_each_entry_safe(fwmsg, safe, &isys->framebuflist, head)
> +		dma_free_attrs(&auxdev->dev, sizeof(struct isys_fw_msgs),
> +			       fwmsg, fwmsg->dma_addr, 0);

This is also done in isys_remove(). How about moving these into a new
function that releases memory from both lists?

There's no harm in traversing framebuflist_fw as well, it's empty at this
point.

> +
>  out_remove_pkg_dir_shared_buffer:
>  	if (!isp->secure_mode)
>  		ipu6_cpd_free_pkg_dir(adev);

-- 
Kind regards,

Sakari Ailus