linux-kernel - Re: [PATCH] memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5b4dc6a3-f6fd-4bf7-a84e-3d79db8d062e@easystack.cn>
Date: Thu, 31 Jul 2025 17:40:26 +0800
From: "zhen.ni" <zhen.ni@...ystack.cn>
To: Krzysztof Kozlowski <krzk@...nel.org>, alim.akhtar@...sung.com
Cc: linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
 linux-samsung-soc@...r.kernel.org
Subject: Re: [PATCH] memory: samsung: exynos-srom: Fix of_iomap leak in
 exynos_srom_probe

Hi,

During static analysis with Smatch, I identified the following issue:

```
drivers/memory/samsung/exynos-srom.c:155 exynos_srom_probe()
warn: 'srom->reg_base' from of_iomap() not released on lines: 155.
```

Problem analysis:
1. In exynos_srom_probe(), the reg_base resource is acquired via of_iomap()
2. The of_platform_populate() call at the end of the function has a 
possible failure path:
```
root = root ? of_node_get(root) : of_find_node_by_path("/");
if (!root)
      return -EINVAL; // Failure return point
```
3. When this path is taken, reg_base is not released, causing a resource 
leak

Verification:
After applying the patch, the Smatch warning is resolved


Best regards,
Zhen


在 2025/7/31 17:06, Krzysztof Kozlowski 写道:
> On 31/07/2025 10:33, Zhen Ni wrote:
>> The current error handling in exynos_srom_probe() has a resource leak
>> in the of_platform_populate() failure path. When this function fails
>> after successful resource allocation, srom->reg_base is not released.
>>
>> To fix this issue, replace of_iomap() with
>> devm_platform_ioremap_resource(). devm_platform_ioremap_resource()
>> is a specialized function for platform devices.
> 
> Don't explain us kernel code. Drop sentence.
> 
>> It allows 'srom->reg_base' to be automatically released whether the
>> probe function succeeds or fails.
> 
> It's obvious.
> 
>>
>> Besides, use IS_ERR() instead of !srom->reg_base
> 
> I don't understand this. You keep explaining the code and this suggests
> you made change here not related to original case. Can you return
> srom->reg_base here? No?
> 
> 
>> as the return value of devm_platform_ioremap_resource()
>> can either be a pointer to the remapped memory or
>> an ERR_PTR() encoded error code if the operation fails.
>>
> 
> Missing fixes and cc-stable.
> 
>> Signed-off-by: Zhen Ni <zhen.ni@...ystack.cn>
>> ---
>>   drivers/memory/samsung/exynos-srom.c | 10 ++++------
>>   1 file changed, 4 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/memory/samsung/exynos-srom.c b/drivers/memory/samsung/exynos-srom.c
>> index e73dd330af47..d913fb901973 100644
>> --- a/drivers/memory/samsung/exynos-srom.c
>> +++ b/drivers/memory/samsung/exynos-srom.c
>> @@ -121,20 +121,18 @@ static int exynos_srom_probe(struct platform_device *pdev)
>>   		return -ENOMEM;
>>   
>>   	srom->dev = dev;
>> -	srom->reg_base = of_iomap(np, 0);
>> -	if (!srom->reg_base) {
>> +	srom->reg_base = devm_platform_ioremap_resource(pdev, 0);
>> +	if (IS_ERR(srom->reg_base)) {
>>   		dev_err(&pdev->dev, "iomap of exynos srom controller failed\n");
>> -		return -ENOMEM;
>> +		return PTR_ERR(srom->reg_base);
> 
> How did you test it?
> 
> Best regards,
> Krzysztof
> 
>