2019-03-22 03:06:03

by Wen Yang

[permalink] [raw]
Subject: [PATCH 1/3] net: xilinx: fix possible object reference leak

The call to of_parse_phandle returns a node pointer with refcount
incremented thus it must be explicitly decremented after the last
usage.

Detected by coccinelle with the following warnings:
./drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1624:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1569, but without a corresponding object release within this function.

Signed-off-by: Wen Yang <[email protected]>
Cc: Anirudha Sarangi <[email protected]>
Cc: John Linn <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: Michal Simek <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
---
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index ec7e7ec..4041c75 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1575,12 +1575,14 @@ static int axienet_probe(struct platform_device *pdev)
ret = of_address_to_resource(np, 0, &dmares);
if (ret) {
dev_err(&pdev->dev, "unable to get DMA resource\n");
+ of_node_put(np);
goto free_netdev;
}
lp->dma_regs = devm_ioremap_resource(&pdev->dev, &dmares);
if (IS_ERR(lp->dma_regs)) {
dev_err(&pdev->dev, "could not map DMA regs\n");
ret = PTR_ERR(lp->dma_regs);
+ of_node_put(np);
goto free_netdev;
}
lp->rx_irq = irq_of_parse_and_map(np, 1);
--
2.9.5



2019-03-22 03:06:04

by Wen Yang

[permalink] [raw]
Subject: [PATCH 2/3] net: ibm: fix possible object reference leak

The call to ehea_get_eth_dn returns a node pointer with refcount
incremented thus it must be explicitly decremented after the last
usage.

Detected by coccinelle with the following warnings:
./drivers/net/ethernet/ibm/ehea/ehea_main.c:3163:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 3154, but without a corresponding object release within this function.

Signed-off-by: Wen Yang <[email protected]>
Cc: Douglas Miller <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: [email protected]
Cc: [email protected]
---
drivers/net/ethernet/ibm/ehea/ehea_main.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 3baabdc..90b62c1 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -3160,6 +3160,7 @@ static ssize_t ehea_probe_port(struct device *dev,

if (ehea_add_adapter_mr(adapter)) {
pr_err("creating MR failed\n");
+ of_node_put(eth_dn);
return -EIO;
}

--
2.9.5


2019-03-22 03:08:56

by Wen Yang

[permalink] [raw]
Subject: [PATCH 3/3] net: ethernet: ti: fix possible object reference leak

The call to of_get_child_by_name returns a node pointer with refcount
incremented thus it must be explicitly decremented after the last
usage.

Detected by coccinelle with the following warnings:
./drivers/net/ethernet/ti/netcp_ethss.c:3661:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 3654, but without a corresponding object release within this function.
./drivers/net/ethernet/ti/netcp_ethss.c:3665:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 3654, but without a corresponding object release within this function.

Signed-off-by: Wen Yang <[email protected]>
Cc: Wingman Kwok <[email protected]>
Cc: Murali Karicheri <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: [email protected]
Cc: [email protected]
---
drivers/net/ethernet/ti/netcp_ethss.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c
index 5174d31..0a920c5 100644
--- a/drivers/net/ethernet/ti/netcp_ethss.c
+++ b/drivers/net/ethernet/ti/netcp_ethss.c
@@ -3657,12 +3657,16 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev,

ret = netcp_txpipe_init(&gbe_dev->tx_pipe, netcp_device,
gbe_dev->dma_chan_name, gbe_dev->tx_queue_id);
- if (ret)
+ if (ret) {
+ of_node_put(interfaces);
return ret;
+ }

ret = netcp_txpipe_open(&gbe_dev->tx_pipe);
- if (ret)
+ if (ret) {
+ of_node_put(interfaces);
return ret;
+ }

/* Create network interfaces */
INIT_LIST_HEAD(&gbe_dev->gbe_intf_head);
--
2.9.5


2019-03-24 01:22:36

by David Miller

[permalink] [raw]
Subject: Re: [PATCH 1/3] net: xilinx: fix possible object reference leak

From: Wen Yang <[email protected]>
Date: Fri, 22 Mar 2019 11:04:07 +0800

> The call to of_parse_phandle returns a node pointer with refcount
> incremented thus it must be explicitly decremented after the last
> usage.
>
> Detected by coccinelle with the following warnings:
> ./drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1624:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1569, but without a corresponding object release within this function.
>
> Signed-off-by: Wen Yang <[email protected]>

Applied.

2019-03-24 01:22:50

by David Miller

[permalink] [raw]
Subject: Re: [PATCH 2/3] net: ibm: fix possible object reference leak

From: Wen Yang <[email protected]>
Date: Fri, 22 Mar 2019 11:04:08 +0800

> The call to ehea_get_eth_dn returns a node pointer with refcount
> incremented thus it must be explicitly decremented after the last
> usage.
>
> Detected by coccinelle with the following warnings:
> ./drivers/net/ethernet/ibm/ehea/ehea_main.c:3163:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 3154, but without a corresponding object release within this function.
>
> Signed-off-by: Wen Yang <[email protected]>

Applied.

2019-03-24 01:23:31

by David Miller

[permalink] [raw]
Subject: Re: [PATCH 3/3] net: ethernet: ti: fix possible object reference leak

From: Wen Yang <[email protected]>
Date: Fri, 22 Mar 2019 11:04:09 +0800

> The call to of_get_child_by_name returns a node pointer with refcount
> incremented thus it must be explicitly decremented after the last
> usage.
>
> Detected by coccinelle with the following warnings:
> ./drivers/net/ethernet/ti/netcp_ethss.c:3661:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 3654, but without a corresponding object release within this function.
> ./drivers/net/ethernet/ti/netcp_ethss.c:3665:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 3654, but without a corresponding object release within this function.
>
> Signed-off-by: Wen Yang <[email protected]>

Applied.

2019-04-05 07:56:31

by Markus Elfring

[permalink] [raw]
Subject: Re: [PATCH 1/3] net: xilinx: fix possible object reference leak

> @@ -1575,12 +1575,14 @@ static int axienet_probe(struct platform_device *pdev)
> ret = of_address_to_resource(np, 0, &dmares);
> if (ret) {
> dev_err(&pdev->dev, "unable to get DMA resource\n");
> + of_node_put(np);
> goto free_netdev;
> }
> lp->dma_regs = devm_ioremap_resource(&pdev->dev, &dmares);
> if (IS_ERR(lp->dma_regs)) {
> dev_err(&pdev->dev, "could not map DMA regs\n");
> ret = PTR_ERR(lp->dma_regs);
> + of_node_put(np);
> goto free_netdev;
> }

How do you think about to move these put calls to an additional
jump target for the desired exception handling?

https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/net/ethernet/xilinx/xilinx_axienet_main.c?id=fa3a419d2f674b431d38748cb58fb7da17ee8949#n1621

Regards,
Markus

2019-04-05 08:15:21

by Dan Carpenter

[permalink] [raw]
Subject: Re: [PATCH 1/3] net: xilinx: fix possible object reference leak

Hi Markus,

Please don't add kernel-janitors to the CC list in the middle of the
conversation. Netdev people can review their own code. We don't have a
copy of the patch your discussing and it's not even clear who you're
responding to.

regards,
dan carpenter

2019-04-05 08:29:13

by Markus Elfring

[permalink] [raw]
Subject: Re: [PATCH 3/3] ethernet: ti: fix possible object reference leak

> @@ -3657,12 +3657,16 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev,
>
> ret = netcp_txpipe_init(&gbe_dev->tx_pipe, netcp_device,
> gbe_dev->dma_chan_name, gbe_dev->tx_queue_id);
> - if (ret)
> + if (ret) {
> + of_node_put(interfaces);
> return ret;
> + }
>
> ret = netcp_txpipe_open(&gbe_dev->tx_pipe);
> - if (ret)
> + if (ret) {
> + of_node_put(interfaces);
> return ret;
> + }
>
> /* Create network interfaces */
> INIT_LIST_HEAD(&gbe_dev->gbe_intf_head);

Would you like to move such duplicate statements to an additional jump target
for the desired exception handling?

Regards,
Markus

2019-04-05 09:20:20

by Markus Elfring

[permalink] [raw]
Subject: Re: [1/3] net: xilinx: fix possible object reference leak

> We don't have a copy of the patch your discussing

I find this information inappropriate because I quoted
a questionable change.

Will any contributors get interested in another update for
the implementation of the function “axienet_probe”?
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/net/ethernet/xilinx/xilinx_axienet_main.c?id=fa3a419d2f674b431d38748cb58fb7da17ee8949#n1576


> and it's not even clear who you're responding to.

I wonder about this feedback.

Regards,
Markus