linux-kernel - Re: [PATCH] mmc: pxamci: Fix passing NULL to PTR_ERR() in pxamci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c0eb8875-b7cf-421d-93d6-6195b13e6930@kernel.org>
Date: Thu, 9 Oct 2025 09:53:04 -0600
From: Khalid Aziz <khalid@...nel.org>
To: Uwe Kleine-König <u.kleine-koenig@...libre.com>,
 Rakuram Eswaran <rakuram.e96@...il.com>
Cc: ulf.hansson@...aro.org, zhoubinbin@...ngson.cn, chenhuacai@...nel.org,
 david.hunter.linux@...il.com, skhan@...uxfoundation.org,
 linux-mmc@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-kernel-mentees@...ts.linux.dev, kernel test robot <lkp@...el.com>,
 Dan Carpenter <dan.carpenter@...aro.org>
Subject: Re: [PATCH] mmc: pxamci: Fix passing NULL to PTR_ERR() in
 pxamci_probe()

On 10/9/25 2:57 AM, Uwe Kleine-König wrote:
> On Tue, Oct 07, 2025 at 09:47:44PM +0530, Rakuram Eswaran wrote:
>> Smatch reported:
>> drivers/mmc/host/pxamci.c:709 pxamci_probe() warn: passing zero to 'PTR_ERR'
>>
>> Case 1:
>> When dma_request_chan() fails, host->dma_chan_rx is an ERR_PTR(),
>> but it is reset to NULL before using PTR_ERR(), resulting in PTR_ERR(0).
>> This mistakenly returns 0 instead of the real error code.
>>
>> Case 2:
>> When devm_clk_get() fails, host->clk is an ERR_PTR() resulting in the similar
>> issue like case 1.
>>
>> Store the error code before nullifying the pointers in both the cases.
> 
> Why is the pointer set to NULL at all? This is in both cases memory that
> is freed directly afterwards (as `host` is devm managed). So I'd claim

I am not sure that sounds right. Looking at the code for 
__devm_clk_get(), if devres_alloc() fails, it returns -ENOMEM. If any of 
the other steps after a successful devres_alloc() fail, code goes 
through possibly clk_put() if needed and then devres_free(). So the 
resources are already freed at this point before the return to 
pxamci_probe(). The only thing left to do is to set host->clk to NULL 
since it would be set to an error pointer at this point.

Am I missing something?

Thanks,
Khalid


> 
> diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
> index 26d03352af63..404f78198252 100644
> --- a/drivers/mmc/host/pxamci.c
> +++ b/drivers/mmc/host/pxamci.c
> @@ -652,10 +652,8 @@ static int pxamci_probe(struct platform_device *pdev)
>   	host->clkrt = CLKRT_OFF;
>   
>   	host->clk = devm_clk_get(dev, NULL);
> -	if (IS_ERR(host->clk)) {
> -		host->clk = NULL;
> +	if (IS_ERR(host->clk))
>   		return PTR_ERR(host->clk);
> -	}
>   
>   	host->clkrate = clk_get_rate(host->clk);
>   
> @@ -704,11 +702,9 @@ static int pxamci_probe(struct platform_device *pdev)
>   	platform_set_drvdata(pdev, mmc);
>   
>   	host->dma_chan_rx = dma_request_chan(dev, "rx");
> -	if (IS_ERR(host->dma_chan_rx)) {
> -		host->dma_chan_rx = NULL;
> +	if (IS_ERR(host->dma_chan_rx))
>   		return dev_err_probe(dev, PTR_ERR(host->dma_chan_rx),
>   				     "unable to request rx dma channel\n");
> -	}
>   
>   	host->dma_chan_tx = dma_request_chan(dev, "tx");
>   	if (IS_ERR(host->dma_chan_tx)) {
> 
> is a superior patch.
> 
> Best regards
> Uwe