linux-kernel - Re: [PATCH] media: intel/ipu6: Fix an error handling path in isys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 20 May 2024 12:53:46 +0200
From: Christophe JAILLET <christophe.jaillet@...adoo.fr>
To: Sakari Ailus <sakari.ailus@...ux.intel.com>
Cc: Bingbu Cao <bingbu.cao@...el.com>, Tianshu Qiu <tian.shu.qiu@...el.com>,
 Mauro Carvalho Chehab <mchehab@...nel.org>,
 Hans de Goede <hdegoede@...hat.com>, Hans Verkuil
 <hverkuil-cisco@...all.nl>, linux-kernel@...r.kernel.org,
 kernel-janitors@...r.kernel.org, linux-media@...r.kernel.org
Subject: Re: [PATCH] media: intel/ipu6: Fix an error handling path in
 isys_probe()

Le 20/05/2024 à 12:47, Sakari Ailus a écrit :
> Hi Christophe,
> 
> Thanks for the patch.
> 
> On Mon, May 20, 2024 at 12:32:30PM +0200, Christophe JAILLET wrote:
>> If an error occurs after a successful alloc_fw_msg_bufs() call, some
>> resources should be released as already done in the remove function.
>>
>> Fixes: f50c4ca0a820 ("media: intel/ipu6: add the main input system driver")
>> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
>> ---
>> Compile tested only
>> ---
>>   drivers/media/pci/intel/ipu6/ipu6-isys.c | 8 +++++++-
>>   1 file changed, 7 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys.c b/drivers/media/pci/intel/ipu6/ipu6-isys.c
>> index 5992138c7290..d9e1e1a135b9 100644
>> --- a/drivers/media/pci/intel/ipu6/ipu6-isys.c
>> +++ b/drivers/media/pci/intel/ipu6/ipu6-isys.c
>> @@ -1062,6 +1062,7 @@ static int isys_probe(struct auxiliary_device *auxdev,
>>   	const struct ipu6_isys_internal_csi2_pdata *csi2_pdata;
>>   	struct ipu6_bus_device *adev = auxdev_to_adev(auxdev);
>>   	struct ipu6_device *isp = adev->isp;
>> +	struct isys_fw_msgs *fwmsg, *safe;
>>   	const struct firmware *fw;
>>   	struct ipu6_isys *isys;
>>   	unsigned int i;
>> @@ -1140,12 +1141,17 @@ static int isys_probe(struct auxiliary_device *auxdev,
>>   
>>   	ret = isys_register_devices(isys);
>>   	if (ret)
>> -		goto out_remove_pkg_dir_shared_buffer;
>> +		goto free_fw_msg_bufs;
>>   
>>   	ipu6_mmu_hw_cleanup(adev->mmu);
>>   
>>   	return 0;
>>   
>> +free_fw_msg_bufs:
>> +	list_for_each_entry_safe(fwmsg, safe, &isys->framebuflist, head)
>> +		dma_free_attrs(&auxdev->dev, sizeof(struct isys_fw_msgs),
>> +			       fwmsg, fwmsg->dma_addr, 0);
> 
> This is also done in isys_remove(). How about moving these into a new
> function that releases memory from both lists?

I agree. I thought about that too but decided to propose a simple 
solution first.

> 
> There's no harm in traversing framebuflist_fw as well, it's empty at this
> point.

Yes, that's my understanding.
That's why I only copied one list_for_each_entry_safe().


I'll send a v2 with the list_for_each_entry_safe() in a new function.
It will be much cleaner.

CJ

> 
>> +
>>   out_remove_pkg_dir_shared_buffer:
>>   	if (!isp->secure_mode)
>>   		ipu6_cpd_free_pkg_dir(adev);
>