From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
To: Dan Carpenter <dan.carpenter@oracle.com>,
Maxime Ripard <maxime@cerno.tech>
Cc: song.bao.hua@hisilicon.com, jernej.skrabec@siol.net,
f.fainelli@gmail.com, leon@kernel.org, timur@kernel.org,
netdev@vger.kernel.org, wangyunjian@huawei.com,
kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org,
wens@csie.org, kuba@kernel.org, sr@denx.de, davem@davemloft.net,
linux-arm-kernel@lists.infradead.org, hkallweit1@gmail.com
Subject: Re: [PATCH] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
Date: Tue, 15 Dec 2020 21:15:46 +0100 [thread overview]
Message-ID: <cad6143c-a5bb-37a8-cff1-86b0fb7c8708@wanadoo.fr> (raw)
In-Reply-To: <20201215193545.GJ2809@kadam>
Le 15/12/2020 à 20:35, Dan Carpenter a écrit :
> On Tue, Dec 15, 2020 at 08:08:15PM +0100, Maxime Ripard wrote:
>> On Tue, Dec 15, 2020 at 07:18:48PM +0100, Christophe JAILLET wrote:
>>> Le 15/12/2020 à 12:37, Maxime Ripard a écrit :
>>>> On Tue, Dec 15, 2020 at 12:11:53PM +0300, Dan Carpenter wrote:
>>>>> On Tue, Dec 15, 2020 at 09:56:55AM +0100, Maxime Ripard wrote:
>>>>>> Hi,
>>>>>>
>>>>>> On Mon, Dec 14, 2020 at 09:21:17PM +0100, Christophe JAILLET wrote:
>>>>>>> 'irq_of_parse_and_map()' should be balanced by a corresponding
>>>>>>> 'irq_dispose_mapping()' call. Otherwise, there is some resources leaks.
>>>>>>
>>>>>> Do you have a source to back that? It's not clear at all from the
>>>>>> documentation for those functions, and couldn't find any user calling it
>>>>>> from the ten-or-so random picks I took.
>>>>>
>>>>> It looks like irq_create_of_mapping() needs to be freed with
>>>>> irq_dispose_mapping() so this is correct.
>>>>
>>>> The doc should be updated first to make that clear then, otherwise we're
>>>> going to fix one user while multiples will have poped up
>>>>
>>>> Maxime
>>>>
>>>
>>> Hi,
>>>
>>> as Dan explained, I think that 'irq_dispose_mapping()' is needed because of
>>> the 'irq_create_of_mapping()" within 'irq_of_parse_and_map()'.
>>>
>>> As you suggest, I'll propose a doc update to make it clear and more future
>>> proof.
>>
>> Thanks :)
>>
>> And if you feel like it, a coccinelle script would be awesome too so
>> that other users get fixed over time
>>
>> Maxime
>
> Smatch has a new check for resource leaks which hopefully people will
> find useful.
>
> https://github.com/error27/smatch/blob/master/check_unwind.c
Nice :)
I wasn't aware of it.
>
> To check for these I would need to add the following lines to the table:
>
> { "irq_of_parse_and_map", ALLOC, -1, "$", &int_one, &int_max},
> { "irq_create_of_mapping", ALLOC, -1, "$", &int_one, &int_max},
> { "irq_dispose_mapping", RELEASE, 0, "$"},
>
> The '-1, "$"' means the returned value. irq_of_parse_and_map() and
> irq_create_of_mapping() return positive int on success.
>
> The irq_dispose_mapping() frees its zeroth parameter so it's listed as
> '0, "$"'. We don't care about the returns from irq_dispose_mapping().
>
> It doesn't apply in this case but if a function frees a struct member
> then that's listed as '0, "$->member_name"'.
>
> regards,
> dan carpenter
>
The script I use to try to spot missing release function is:
///
@@
expression x, y;
identifier f, l;
@@
* x = irq_of_parse_and_map(...);
... when any
* y = f(...);
... when any
* if (<+... y ...+>)
{
...
(
* goto l;
|
* return ...;
)
...
}
... when any
*l:
... when != irq_dispose_mapping(...);
* return ...;
///
It is likely that some improvement can be made, but it works pretty well
for what I want.
And I have a collection of alloc/free functions that I manually put in
place of irq_of_parse_and_map and irq_dispose_mapping.
Up to know, this list is:
// alloc_etherdev/alloc_etherdev_mq/alloc_etherdev_mqs - free_netdev
// alloc_workqueue - destroy_workqueue
// class_register - class_unregister
// clk_get - clk_put
// clk_prepare - clk_unprepare
// create_workqueue - destroy_workqueue
// create_singlethread_workqueue - destroy_workqueue
//
dev_pm_domain_attach/dev_pm_domain_attach_by_id/dev_pm_domain_attach_by_name
- dev_pm_domain_detach
// devres_alloc - devres_free
// dma_alloc_coherent - dma_free_coherent
// dma_map_resource - dma_unmap_resource
// dma_map_single - dma_unmap_single
// dma_request_slave_channel - dma_release_channel
// dma_request_chan - dma_release_channel
// framebuffer_alloc - framebuffer_release
// get_device - put_device
// iio_channel_get - iio_channel_release
// ioremap - iounmap
// input_allocate_device - input_free_device
// input_register_handle - input_unregister_handle
// irq_of_parse_and_map / irq_create_of_mapping - irq_dispose_mapping
// kmalloc - kfree
// mempool_alloc - mempool_free
// of_node_get - of_node_put
// of_reserved_mem_device_init - of_reserved_mem_device_release
// pinctrl_register - pinctrl_unregister
// request_irq - free_irq
// request_region - release_region
// request_mem_region - release_mem_region
// reset_control_assert - reset_control_deassert
// scsi_host_alloc - scsi_host_put
// pci_alloc_irq_vectors - pci_free_irq_vectors
// pci_dev_get - pci_dev_put
// pci_enable_device - pci_disable_device
// pci_iomap - pci_iounmap
// pci_request_region - pci_release_region
// pci_request_regions - pci_release_regions
// alloc_skb/__alloc_skb - kfree_skb/__kfree_skb
// dev_alloc_skb - dev_kfree_skb
// spi_dev_get - spi_dev_put
// spi_message_alloc - spi_message_free
// spi_register_master - spi_unregister_master
next prev parent reply other threads:[~2020-12-15 20:18 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-14 20:21 [PATCH] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function Christophe JAILLET
2020-12-15 8:56 ` Maxime Ripard
2020-12-15 9:11 ` Dan Carpenter
2020-12-15 11:37 ` Maxime Ripard
2020-12-15 18:18 ` Christophe JAILLET
2020-12-15 19:08 ` Maxime Ripard
2020-12-15 19:35 ` Dan Carpenter
2020-12-15 20:15 ` Christophe JAILLET [this message]
[not found] ` <902018a7-19eb-cd15-5fde-6e0564fcd95c@wanadoo.fr>
2020-12-16 3:23 ` Chen-Yu Tsai
2020-12-16 19:50 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cad6143c-a5bb-37a8-cff1-86b0fb7c8708@wanadoo.fr \
--to=christophe.jaillet@wanadoo.fr \
--cc=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=f.fainelli@gmail.com \
--cc=hkallweit1@gmail.com \
--cc=jernej.skrabec@siol.net \
--cc=kernel-janitors@vger.kernel.org \
--cc=kuba@kernel.org \
--cc=leon@kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maxime@cerno.tech \
--cc=netdev@vger.kernel.org \
--cc=song.bao.hua@hisilicon.com \
--cc=sr@denx.de \
--cc=timur@kernel.org \
--cc=wangyunjian@huawei.com \
--cc=wens@csie.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).