[PATCH 2/2] ath11k: Handle errors if peer creation fails

[PATCH 2/2] ath11k: Handle errors if peer creation fails

[Alex Dewar]

ath11k_peer_create() is called without its return value being checked,
meaning errors will be unhandled. Add missing check and, as the mutex is
unconditionally unlocked on leaving this function, simplify the exit
path.

Addresses-Coverity-ID: 1497531 ("Code maintainability issues")
Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390")
Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
---
 drivers/net/wireless/ath/ath11k/mac.c | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 7f8dd47d2333..58db1b57b941 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -5211,7 +5211,7 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
 	struct ath11k *ar = hw->priv;
 	struct ath11k_base *ab = ar->ab;
 	struct ath11k_vif *arvif = (void *)vif->drv_priv;
-	int ret;
+	int ret = 0;
 	struct peer_create_params param;
 
 	mutex_lock(&ar->conf_mutex);
@@ -5225,13 +5225,12 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
 	    arvif->vdev_type != WMI_VDEV_TYPE_AP &&
 	    arvif->vdev_type != WMI_VDEV_TYPE_MONITOR) {
 		memcpy(&arvif->chanctx, ctx, sizeof(*ctx));
-		mutex_unlock(&ar->conf_mutex);
-		return 0;
+		goto unlock;
 	}
 
 	if (WARN_ON(arvif->is_started)) {
-		mutex_unlock(&ar->conf_mutex);
-		return -EBUSY;
+		ret = -EBUSY;
+		goto unlock;
 	}
 
 	if (ab->hw_params.vdev_start_delay) {
@@ -5239,6 +5238,8 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
 		param.peer_type = WMI_PEER_TYPE_DEFAULT;
 		param.peer_addr = ar->mac_addr;
 		ret = ath11k_peer_create(ar, arvif, NULL, &param);
+		if (ret)
+			goto unlock;
 	}
 
 	ret = ath11k_mac_vdev_start(arvif, &ctx->def);
@@ -5246,23 +5247,19 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
 		ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n",
 			    arvif->vdev_id, vif->addr,
 			    ctx->def.chan->center_freq, ret);
-		goto err;
+		goto unlock;
 	}
 	if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) {
 		ret = ath11k_monitor_vdev_up(ar, arvif->vdev_id);
 		if (ret)
-			goto err;
+			goto unlock;
 	}
 
 	arvif->is_started = true;
 
 	/* TODO: Setup ps and cts/rts protection */
 
-	mutex_unlock(&ar->conf_mutex);
-
-	return 0;
-
-err:
+unlock:
 	mutex_unlock(&ar->conf_mutex);
 
 	return ret;
-- 
2.28.0

[PATCH 1/2] ath11k: Fix memory leak on error path

[Alex Dewar]

In ath11k_mac_setup_iface_combinations(), if memory cannot be assigned
for the variable limits, then the memory assigned to combinations will
be leaked. Fix this.

Addresses-Coverity-ID: 1497534 ("Resource leaks")
Fixes: 2626c269702e ("ath11k: add interface_modes to hw_params")
Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
---
 drivers/net/wireless/ath/ath11k/mac.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 3f63a7bd6b59..7f8dd47d2333 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -6041,8 +6041,10 @@ static int ath11k_mac_setup_iface_combinations(struct ath11k *ar)
 	n_limits = 2;
 
 	limits = kcalloc(n_limits, sizeof(*limits), GFP_KERNEL);
-	if (!limits)
+	if (!limits) {
+		kfree(combinations);
 		return -ENOMEM;
+	}
 
 	limits[0].max = 1;
 	limits[0].types |= BIT(NL80211_IFTYPE_STATION);
-- 
2.28.0

Re: [PATCH 1/2] ath11k: Fix memory leak on error path

[Kalle Valo]

Alex Dewar <alex.dewar90@gmail.com> wrote:

> In ath11k_mac_setup_iface_combinations(), if memory cannot be assigned
> for the variable limits, then the memory assigned to combinations will
> be leaked. Fix this.
> 
> Addresses-Coverity-ID: 1497534 ("Resource leaks")
> Fixes: 2626c269702e ("ath11k: add interface_modes to hw_params")
> Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>

Patch applied to wireless-drivers-next.git, thanks.

8431350eee2e ath11k: Fix memory leak on error path

-- 
https://patchwork.kernel.org/patch/11815579/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH 2/2] ath11k: Handle errors if peer creation fails

[Kalle Valo]

Alex Dewar <alex.dewar90@gmail.com> writes:

> ath11k_peer_create() is called without its return value being checked,
> meaning errors will be unhandled. Add missing check and, as the mutex is
> unconditionally unlocked on leaving this function, simplify the exit
> path.
>
> Addresses-Coverity-ID: 1497531 ("Code maintainability issues")
> Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390")
> Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
> ---
>  drivers/net/wireless/ath/ath11k/mac.c | 21 +++++++++------------
>  1 file changed, 9 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
> index 7f8dd47d2333..58db1b57b941 100644
> --- a/drivers/net/wireless/ath/ath11k/mac.c
> +++ b/drivers/net/wireless/ath/ath11k/mac.c
> @@ -5211,7 +5211,7 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
>  	struct ath11k *ar = hw->priv;
>  	struct ath11k_base *ab = ar->ab;
>  	struct ath11k_vif *arvif = (void *)vif->drv_priv;
> -	int ret;
> +	int ret = 0;

I prefer not to initialise the ret variable.

>  	arvif->is_started = true;
>  
>  	/* TODO: Setup ps and cts/rts protection */
>  
> -	mutex_unlock(&ar->conf_mutex);
> -
> -	return 0;
> -
> -err:
> +unlock:
>  	mutex_unlock(&ar->conf_mutex);
>  
>  	return ret;

So in the pending branch I changed this to:

	ret = 0;

out:
	mutex_unlock(&ar->conf_mutex);

	return ret;

Please check.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH 2/2] ath11k: Handle errors if peer creation fails

[Alex Dewar]

On Tue, Oct 06, 2020 at 10:26:28AM +0300, Kalle Valo wrote:
> Alex Dewar <alex.dewar90@gmail.com> writes:
> 
> > ath11k_peer_create() is called without its return value being checked,
> > meaning errors will be unhandled. Add missing check and, as the mutex is
> > unconditionally unlocked on leaving this function, simplify the exit
> > path.
> >
> > Addresses-Coverity-ID: 1497531 ("Code maintainability issues")
> > Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390")
> > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
> > ---
> >  drivers/net/wireless/ath/ath11k/mac.c | 21 +++++++++------------
> >  1 file changed, 9 insertions(+), 12 deletions(-)
> >
> > diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
> > index 7f8dd47d2333..58db1b57b941 100644
> > --- a/drivers/net/wireless/ath/ath11k/mac.c
> > +++ b/drivers/net/wireless/ath/ath11k/mac.c
> > @@ -5211,7 +5211,7 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
> >  	struct ath11k *ar = hw->priv;
> >  	struct ath11k_base *ab = ar->ab;
> >  	struct ath11k_vif *arvif = (void *)vif->drv_priv;
> > -	int ret;
> > +	int ret = 0;
> 
> I prefer not to initialise the ret variable.
> 
> >  	arvif->is_started = true;
> >  
> >  	/* TODO: Setup ps and cts/rts protection */
> >  
> > -	mutex_unlock(&ar->conf_mutex);
> > -
> > -	return 0;
> > -
> > -err:
> > +unlock:
> >  	mutex_unlock(&ar->conf_mutex);
> >  
> >  	return ret;
> 
> So in the pending branch I changed this to:
> 
> 	ret = 0;
> 
> out:
> 	mutex_unlock(&ar->conf_mutex);
> 
> 	return ret;
> 
> Please check.

Hi Kalle,

I'm afraid you've introduced a bug ;). The body of the first if-statement
in the function doesn't set ret because no error has occurred. So now
it'll jump to the label and the function will return ret uninitialized.

With the gcc extension, ret will be initialised to zero anyway, so we're
not saving anything by explicitly assigning to ret later in the
function.

Best,
Alex

> 
> -- 
> https://patchwork.kernel.org/project/linux-wireless/list/
> 
> https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH 2/2] ath11k: Handle errors if peer creation fails

[Kalle Valo]

Alex Dewar <alex.dewar90@gmail.com> writes:

> On Tue, Oct 06, 2020 at 10:26:28AM +0300, Kalle Valo wrote:
>> Alex Dewar <alex.dewar90@gmail.com> writes:
>> 
>> > ath11k_peer_create() is called without its return value being checked,
>> > meaning errors will be unhandled. Add missing check and, as the mutex is
>> > unconditionally unlocked on leaving this function, simplify the exit
>> > path.
>> >
>> > Addresses-Coverity-ID: 1497531 ("Code maintainability issues")
>> > Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390")
>> > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
>> > ---
>> >  drivers/net/wireless/ath/ath11k/mac.c | 21 +++++++++------------
>> >  1 file changed, 9 insertions(+), 12 deletions(-)
>> >
>> > diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
>> > index 7f8dd47d2333..58db1b57b941 100644
>> > --- a/drivers/net/wireless/ath/ath11k/mac.c
>> > +++ b/drivers/net/wireless/ath/ath11k/mac.c
>> > @@ -5211,7 +5211,7 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
>> >  	struct ath11k *ar = hw->priv;
>> >  	struct ath11k_base *ab = ar->ab;
>> >  	struct ath11k_vif *arvif = (void *)vif->drv_priv;
>> > -	int ret;
>> > +	int ret = 0;
>> 
>> I prefer not to initialise the ret variable.
>> 
>> >  	arvif->is_started = true;
>> >  
>> >  	/* TODO: Setup ps and cts/rts protection */
>> >  
>> > -	mutex_unlock(&ar->conf_mutex);
>> > -
>> > -	return 0;
>> > -
>> > -err:
>> > +unlock:
>> >  	mutex_unlock(&ar->conf_mutex);
>> >  
>> >  	return ret;
>> 
>> So in the pending branch I changed this to:
>> 
>> 	ret = 0;
>> 
>> out:
>> 	mutex_unlock(&ar->conf_mutex);
>> 
>> 	return ret;
>> 
>> Please check.
>
> I'm afraid you've introduced a bug ;). The body of the first if-statement
> in the function doesn't set ret because no error has occurred. So now
> it'll jump to the label and the function will return ret uninitialized.

Ouch, so I did. Good catch! I would have hoped that GCC warns about that
but it didn't.

I fixed the bug and added also a warning messages if peer_create()
fails:

https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?h=pending&id=e3e7b8072fa6bb0928b9066cf76e19e6bd2ec663

Does this look better now? :)

> With the gcc extension, ret will be initialised to zero anyway, so we're
> not saving anything by explicitly assigning to ret later in the
> function.

I prefer not to initialise ret in the beginning of the function and I
try to maintain that style in ath11k. I think it's more readable that
the error value is assigned just before the goto.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH 2/2] ath11k: Handle errors if peer creation fails

[Alex Dewar]

On Sat, Nov 07, 2020 at 01:23:30PM +0200, Kalle Valo wrote:
> Alex Dewar <alex.dewar90@gmail.com> writes:
> 
> > On Tue, Oct 06, 2020 at 10:26:28AM +0300, Kalle Valo wrote:
> >> Alex Dewar <alex.dewar90@gmail.com> writes:
> >> 
> >> > ath11k_peer_create() is called without its return value being checked,
> >> > meaning errors will be unhandled. Add missing check and, as the mutex is
> >> > unconditionally unlocked on leaving this function, simplify the exit
> >> > path.
> >> >
> >> > Addresses-Coverity-ID: 1497531 ("Code maintainability issues")
> >> > Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390")
> >> > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
> >> > ---
> >> >  drivers/net/wireless/ath/ath11k/mac.c | 21 +++++++++------------
> >> >  1 file changed, 9 insertions(+), 12 deletions(-)
> >> >
> >> > diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
> >> > index 7f8dd47d2333..58db1b57b941 100644
> >> > --- a/drivers/net/wireless/ath/ath11k/mac.c
> >> > +++ b/drivers/net/wireless/ath/ath11k/mac.c
> >> > @@ -5211,7 +5211,7 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
> >> >  	struct ath11k *ar = hw->priv;
> >> >  	struct ath11k_base *ab = ar->ab;
> >> >  	struct ath11k_vif *arvif = (void *)vif->drv_priv;
> >> > -	int ret;
> >> > +	int ret = 0;
> >> 
> >> I prefer not to initialise the ret variable.
> >> 
> >> >  	arvif->is_started = true;
> >> >  
> >> >  	/* TODO: Setup ps and cts/rts protection */
> >> >  
> >> > -	mutex_unlock(&ar->conf_mutex);
> >> > -
> >> > -	return 0;
> >> > -
> >> > -err:
> >> > +unlock:
> >> >  	mutex_unlock(&ar->conf_mutex);
> >> >  
> >> >  	return ret;
> >> 
> >> So in the pending branch I changed this to:
> >> 
> >> 	ret = 0;
> >> 
> >> out:
> >> 	mutex_unlock(&ar->conf_mutex);
> >> 
> >> 	return ret;
> >> 
> >> Please check.
> >
> > I'm afraid you've introduced a bug ;). The body of the first if-statement
> > in the function doesn't set ret because no error has occurred. So now
> > it'll jump to the label and the function will return ret uninitialized.
> 
> Ouch, so I did. Good catch! I would have hoped that GCC warns about that
> but it didn't.
> 
> I fixed the bug and added also a warning messages if peer_create()
> fails:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?h=pending&id=e3e7b8072fa6bb0928b9066cf76e19e6bd2ec663
> 
> Does this look better now? :)

LGTM!

> 
> > With the gcc extension, ret will be initialised to zero anyway, so we're
> > not saving anything by explicitly assigning to ret later in the
> > function.
> 
> I prefer not to initialise ret in the beginning of the function and I
> try to maintain that style in ath11k. I think it's more readable that
> the error value is assigned just before the goto.

Fair enough. I appreciate that it's a style issue.

> 
> -- 
> https://patchwork.kernel.org/project/linux-wireless/list/
> 
> https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH 2/2] ath11k: Handle errors if peer creation fails

[Kalle Valo]

Alex Dewar <alex.dewar90@gmail.com> wrote:

> ath11k_peer_create() is called without its return value being checked,
> meaning errors will be unhandled. Add missing check and, as the mutex is
> unconditionally unlocked on leaving this function, simplify the exit
> path.
> 
> Addresses-Coverity-ID: 1497531 ("Code maintainability issues")
> Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390")
> Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Patch applied to ath-next branch of ath.git, thanks.

c134d1f8c436 ath11k: Handle errors if peer creation fails

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20201004100218.311653-1-alex.dewar90@gmail.com/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches