netdev - Re: [PATCH net] phy: fix error case of phy_led_triggers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20161123221525.GD12343@lunn.ch>
Date:   Wed, 23 Nov 2016 23:15:25 +0100
From:   Andrew Lunn <andrew@...n.ch>
To:     Woojung.Huh@...rochip.com
Cc:     zach.brown@...com, davem@...emloft.net, netdev@...r.kernel.org,
        f.fainelli@...il.com
Subject: Re: [PATCH net] phy: fix error case of phy_led_triggers_(un)register

On Wed, Nov 23, 2016 at 09:39:37PM +0000, Woojung.Huh@...rochip.com wrote:
> From: Woojung Huh <woojung.huh@...rochip.com>
> 
> When phy_init_hw() fails at phy_attach_direct();
> - phy_detach() calls phy_led_triggers_unregister() without 
>   previous call of phy_led_triggers_register().
> - still call phy_led_triggers_register() and cause memory leak.
> 
> Signed-off-by: Woojung Huh <woojung.huh@...rochip.com>
> ---
>  drivers/net/phy/phy_device.c       | 6 +++---
>  drivers/net/phy/phy_led_triggers.c | 3 +++
>  2 files changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
> index 9e8f048..094a959 100644
> --- a/drivers/net/phy/phy_device.c
> +++ b/drivers/net/phy/phy_device.c
> @@ -915,10 +915,10 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
>  	err = phy_init_hw(phydev);
>  	if (err)
>  		phy_detach(phydev);
> -	else
> +	else {
>  		phy_resume(phydev);
> -
> -	phy_led_triggers_register(phydev);
> +		phy_led_triggers_register(phydev);
> +	}

Hi Woojung

The code layout is rather unusual, putting the success case inside the
else {}. It would be better to do a goto out: on error, and detach the
phy there.

>  
>  	return err;
>  
> diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c
> index cda600a..3b0b726 100644
> --- a/drivers/net/phy/phy_led_triggers.c
> +++ b/drivers/net/phy/phy_led_triggers.c
> @@ -128,6 +128,9 @@ void phy_led_triggers_unregister(struct phy_device *phy)
>  {
>  	int i;
>  
> +	if (!phy->phy_num_led_triggers)
> +		return;
> +
>  	for (i = 0; i < phy->phy_num_led_triggers; i++)
>  		phy_led_trigger_unregister(&phy->phy_led_triggers[i]);

And this seems to be the wrong fix. The point of devm_kzalloc() is
that you don't need to free it, it will happen automatically. So why
not just remove the devm_kfree(&phy->mdio.dev, phy->phy_led_triggers).

    Andrew