linux-kernel - Re: [PATCH] PCI: fix reference leak in pci_alloc_child

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <73c1bc90-569a-4514-93d4-e6d5e0597607@wanadoo.fr>
Date: Tue, 7 Jan 2025 19:48:28 +0100
From: Christophe JAILLET <christophe.jaillet@...adoo.fr>
To: Ma Ke <make24@...as.ac.cn>, bhelgaas@...gle.com
Cc: linux-pci@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] PCI: fix reference leak in pci_alloc_child_bus()

Le 07/01/2025 à 12:07, Ma Ke a écrit :
> When device_register(&child->dev) failed, calling put_device() to
> explicitly release child->dev. Otherwise, it could cause double free
> problem.
> 
> Found by code review.
> 
> Signed-off-by: Ma Ke <make24@...as.ac.cn>
> ---
>   drivers/pci/probe.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
> index 2e81ab0f5a25..a61070ce5f88 100644
> --- a/drivers/pci/probe.c
> +++ b/drivers/pci/probe.c
> @@ -1174,7 +1174,10 @@ static struct pci_bus *pci_alloc_child_bus(struct pci_bus *parent,
>   add_dev:
>   	pci_set_bus_msi_domain(child);
>   	ret = device_register(&child->dev);
> -	WARN_ON(ret < 0);
> +	if (WARN_ON(ret < 0)) {
> +		put_device(&child->dev);
> +		return ERR_PTR(ret);

Previously, the code was continuing the execution. I don't know it is 
correct to return at this point.

Anyway, returning ERR_PTR(ret) just looks wrong, because 
pci_add_new_bus() expect NULL in case of error.
Should ERR_PTR(ret) be returned, it is likely basd thing would happen there.

CJ

> +	}
>   
>   	pcibios_add_bus(child);
>