linux-kernel - Re: [PATCH] perf/x86/intel/uncore: Fix iounmap() leak on global

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e7d74d9d-cb45-4f5f-8e44-502dd7c4bcff@intel.com>
Date: Wed, 14 Jan 2026 11:41:06 -0800
From: "Chen, Zide" <zide.chen@...el.com>
To: Markus Elfring <Markus.Elfring@....de>, linux-perf-users@...r.kernel.org,
 Adrian Hunter <adrian.hunter@...el.com>,
 Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
 Andi Kleen <ak@...ux.intel.com>, Arnaldo Carvalho de Melo <acme@...nel.org>,
 Dapeng Mi <dapeng1.mi@...ux.intel.com>, Ian Rogers <irogers@...gle.com>,
 Ingo Molnar <mingo@...hat.com>, Peter Zijlstra <peterz@...radead.org>,
 Namhyung Kim <namhyung@...nel.org>, Stephane Eranian <eranian@...gle.com>
Cc: lkp@...el.com, LKML <linux-kernel@...r.kernel.org>,
 kernel-janitors@...r.kernel.org, Thomas Falcon <thomas.falcon@...el.com>,
 Xudong Hao <xudong.hao@...el.com>
Subject: Re: [PATCH] perf/x86/intel/uncore: Fix iounmap() leak on global_init
 failure



On 1/13/2026 11:51 PM, Markus Elfring wrote:
>>>> If domain->global_init() fails in __parse_discovery_table(), the
>>>> mapped MMIO region is not released before returning, resulting in
>>>> an iounmap() leak.
>>>
>>> How do you think about to avoid a bit of duplicate source code here?
>>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/coding-style.rst?h=v6.19-rc5#n526
>>
>> Thank you for the suggestion!
>>
>> Yes, I agree this is better.
> 
> Thanks for this positive feedback.
> 
> 
>> In V1 I followed the existing style in this API.
> 
> This variant might be nicer for backporting.
> 
> 
>> I will post a v2 with this change:
>>
>> @@ -264,6 +264,7 @@ static int __parse_discovery_table(struct
>> uncore_discovery_domain *domain,
>>         struct uncore_unit_discovery unit;
>>         void __iomem *io_addr;
>>         unsigned long size;
>> +       int ret = 0;
>>         int i;
> 
> Would scope adjustments become helpful for any of these local vartiables?

Yes, I agree that moving int i into the for loop would be better, but
I’d prefer to keep this patch focused and leave that change for future
cleanup.


> 
>>         size = UNCORE_DISCOVERY_GLOBAL_MAP_SIZE;
>> @@ -273,21 +274,23 @@ static int __parse_discovery_table(struct
> …
>> -       if (domain->global_init && domain->global_init(global.ctl))
>> -               return -ENODEV;
>> +       if (domain->global_init && domain->global_init(global.ctl)) {
>> +               ret = -ENODEV;
>> +               goto out;
>> +       }
> …
>>         *parsed = true;
>> +
>> +out:
> 
> Would an other label be a bit clearer here?
> 
> unmap_io:

It seems that the perf driver generally uses simple labels such as done,
out, or err.  Additionally, since there is only a single error path
here, I would prefer to keep the label out for style consistency.

> 
>>         iounmap(io_addr);
>> -       return 0;
>> +       return ret;
>>  }
>>
>>  static int parse_discovery_table(struct uncore_discovery_domain
>>
>>> See also once more:
>>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc5#n94
> 
> Will another imperative wording become helpful for an improved change description?

Sure, I’ll try my best to improve the description.

>> Are you suggesting that I add a Closes tag?
> 
> It depends …
> 
> 
>> This issue was reported by Intel internal LKP, and there is no public
>> URL available.
> 
> Thanks for such a bit of background information.
> Some contributors would appreciate further hints on involved development tools
> (and known source code analysis approaches).

I may add the following report to the commit message for additional context:

    Unverified Error/Warning (likely false positive, kindly check if
    interested):
        arch/x86/events/intel/uncore_discovery.c:293:2-8:
        ERROR: missing iounmap; ioremap on line 288 and execution via
        conditional on line 292

> Regards,
> Markus