linux-kernel - Re: [PATCH v3] leds: netxbig: fix GPIO descriptor leak in error paths

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aRzQtvOhYRaWCiFA@black.igk.intel.com>
Date: Tue, 18 Nov 2025 21:01:58 +0100
From: Andy Shevchenko <andriy.shevchenko@...el.com>
To: Haotian Zhang <vulab@...as.ac.cn>
Cc: Lee Jones <lee@...nel.org>, Pavel Machek <pavel@...nel.org>,
	Markus.Elfring@....de, linux-leds@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] leds: netxbig: fix GPIO descriptor leak in error paths

On Fri, Oct 31, 2025 at 10:16:20AM +0800, Haotian Zhang wrote:
> The function netxbig_gpio_ext_get() acquires GPIO descriptors but
> fails to release them when errors occur mid-way through initialization.
> The cleanup callback registered by devm_add_action_or_reset() only
> runs on success, leaving acquired GPIOs leaked on error paths.
> 
> Add goto-based error handling to release all acquired GPIOs before
> returning errors.

...

>  	data = devm_kcalloc(dev, num_data, sizeof(*data), GFP_KERNEL);
> +	if (!data) {
> +		ret = -ENOMEM;
> +		goto err_free_addr;
> +	}
> +
> +	gpio_ext->data = data;
> +	gpio_ext->num_data = 0;
>  
>  	for (i = 0; i < num_data; i++) {
>  		gpiod = gpiod_get_index(gpio_ext_dev, "data", i,
>  					GPIOD_OUT_LOW);
>  		if (IS_ERR(gpiod))
> +			goto err_free_data;
>  		gpiod_set_consumer_name(gpiod, "GPIO extension data");
>  		data[i] = gpiod;
> +		gpio_ext->num_data++;
>  	}

While fixing one issue, this brings wrong order of the devm_ and non-devm
resource cleaning. This may lead in some cases to the crash at ->remove() or on
error path at ->probe().

I think this needs much deeper refactoring, and rethinking. Easiest approach is
to get rid of devm_ allocations altogether with a huge comment why.

That said, NAK to it in _this_ form.
(However I see it is already applied, so perhaps it will be fixed by some
 followups)

-- 
With Best Regards,
Andy Shevchenko