[RFT PATCH 1/2] memory: fsl_ifc: fix leaking IO mapping on probe failure

[RFT PATCH 1/2] memory: fsl_ifc: fix leaking IO mapping on probe failure

[Krzysztof Kozlowski]

On probe error the driver should unmap the IO memory.  Smatch reports:

  drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev->gregs' not released on lines: 298.

Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>

---

Only build tested.
---
 drivers/memory/fsl_ifc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
index 89f99b5b6450..a6324044a085 100644
--- a/drivers/memory/fsl_ifc.c
+++ b/drivers/memory/fsl_ifc.c
@@ -219,8 +219,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 	fsl_ifc_ctrl_dev->gregs = of_iomap(dev->dev.of_node, 0);
 	if (!fsl_ifc_ctrl_dev->gregs) {
 		dev_err(&dev->dev, "failed to get memory region\n");
-		ret = -ENODEV;
-		goto err;
+		return -ENODEV;
 	}
 
 	if (of_property_read_bool(dev->dev.of_node, "little-endian")) {
@@ -295,6 +294,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 	free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev);
 	irq_dispose_mapping(fsl_ifc_ctrl_dev->irq);
 err:
+	iounmap(fsl_ifc_ctrl_dev->gregs);
 	return ret;
 }
 
-- 
2.27.0

[RFT PATCH 2/2] memory: fsl_ifc: fix leak of private memory on probe failure

[Krzysztof Kozlowski]

On probe error the driver should free the memory allocated for private
structure.  Fix this by using resource-managed allocation.

Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>

---

Only build tested.
---
 drivers/memory/fsl_ifc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
index a6324044a085..3ee7183b20fb 100644
--- a/drivers/memory/fsl_ifc.c
+++ b/drivers/memory/fsl_ifc.c
@@ -209,7 +209,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 
 	dev_info(&dev->dev, "Freescale Integrated Flash Controller\n");
 
-	fsl_ifc_ctrl_dev = kzalloc(sizeof(*fsl_ifc_ctrl_dev), GFP_KERNEL);
+	fsl_ifc_ctrl_dev = devm_kzalloc(&dev->dev, sizeof(*fsl_ifc_ctrl_dev),
+					GFP_KERNEL);
 	if (!fsl_ifc_ctrl_dev)
 		return -ENOMEM;
 
-- 
2.27.0

Re: [RFT PATCH 2/2] memory: fsl_ifc: fix leak of private memory on probe failure

[Dan Carpenter]

On Thu, May 27, 2021 at 10:42:40AM -0400, Krzysztof Kozlowski wrote:
> On probe error the driver should free the memory allocated for private
> structure.  Fix this by using resource-managed allocation.
> 
> Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller")
> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
> 
> ---
> 
> Only build tested.
> ---
>  drivers/memory/fsl_ifc.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
> index a6324044a085..3ee7183b20fb 100644
> --- a/drivers/memory/fsl_ifc.c
> +++ b/drivers/memory/fsl_ifc.c
> @@ -209,7 +209,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
>  
>  	dev_info(&dev->dev, "Freescale Integrated Flash Controller\n");
>  
> -	fsl_ifc_ctrl_dev = kzalloc(sizeof(*fsl_ifc_ctrl_dev), GFP_KERNEL);
> +	fsl_ifc_ctrl_dev = devm_kzalloc(&dev->dev, sizeof(*fsl_ifc_ctrl_dev),
> +					GFP_KERNEL);
>  	if (!fsl_ifc_ctrl_dev)
>  		return -ENOMEM;

You'd need to remove the kfree(ctrl) in the remove function as well or
it will lead to a double free.

Unrelated to your patch but related to Smatch.  The Smatch check for
resource leaks which I mentioned check_unwind.c doesn't look for
kmalloc() leaks because those are quite complicated to deal with.
kmalloc() allocations are so much more common and that if you have a 5%
false positive rate, then it's just overwhelming.  There is a separate
Smatch check for that but it's garbage and I need to re-write it.

Also I'm really inspired by Christophe JAILLET's Coccinelle checks which
compare the ->probe and ->remove() functions to see if they match.  So I
may attempt something similar.

regards,
dan carpenter

Re: [RFT PATCH 2/2] memory: fsl_ifc: fix leak of private memory on probe failure

[Krzysztof Kozlowski]

On 27/05/2021 11:01, Dan Carpenter wrote:
> On Thu, May 27, 2021 at 10:42:40AM -0400, Krzysztof Kozlowski wrote:
>> On probe error the driver should free the memory allocated for private
>> structure.  Fix this by using resource-managed allocation.
>>
>> Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller")
>> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
>>
>> ---
>>
>> Only build tested.
>> ---
>>  drivers/memory/fsl_ifc.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
>> index a6324044a085..3ee7183b20fb 100644
>> --- a/drivers/memory/fsl_ifc.c
>> +++ b/drivers/memory/fsl_ifc.c
>> @@ -209,7 +209,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
>>  
>>  	dev_info(&dev->dev, "Freescale Integrated Flash Controller\n");
>>  
>> -	fsl_ifc_ctrl_dev = kzalloc(sizeof(*fsl_ifc_ctrl_dev), GFP_KERNEL);
>> +	fsl_ifc_ctrl_dev = devm_kzalloc(&dev->dev, sizeof(*fsl_ifc_ctrl_dev),
>> +					GFP_KERNEL);
>>  	if (!fsl_ifc_ctrl_dev)
>>  		return -ENOMEM;
> 
> You'd need to remove the kfree(ctrl) in the remove function as well or
> it will lead to a double free.

Yeah, thanks, I spotted it now also looking for more leaks.
> 
> Unrelated to your patch but related to Smatch.  The Smatch check for
> resource leaks which I mentioned check_unwind.c doesn't look for
> kmalloc() leaks because those are quite complicated to deal with.
> kmalloc() allocations are so much more common and that if you have a 5%
> false positive rate, then it's just overwhelming.  There is a separate
> Smatch check for that but it's garbage and I need to re-write it.

Indeed I was thinking about this kmalloc. It should be the last one -
the IRQs seem to be handled.



Best regards,
Krzysztof