2021-09-11 07:07:44

by Xin Xiong

Subject: [PATCH] drivers/dma: fix reference count leaks in mmp_pdma_probe

The issue happens in an error handling path. If
of_dma_controller_register() fails, the function simply prints error
messages and returns error code, without decrementing the reference
count of pdev->device incremented earlier by
dma_async_device_register(), which may result in refcount leaks.

Fix it by invoking dma_async_device_unregister() before returning the
error code.

Signed-off-by: Xin Xiong <[email protected]>
Signed-off-by: Xiyu Yang <[email protected]>
Signed-off-by: Xin Tan <[email protected]>
---
drivers/dma/mmp_pdma.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c
index 89f1814ff..a23563cd1 100644
--- a/drivers/dma/mmp_pdma.c
+++ b/drivers/dma/mmp_pdma.c
@@ -1123,6 +1123,7 @@ static int mmp_pdma_probe(struct platform_device *op)
mmp_pdma_dma_xlate, pdev);
if (ret < 0) {
dev_err(&op->dev, "of_dma_controller_register failed\n");
+ dma_async_device_unregister(&pdev->device);
return ret;
}
}
--
2.25.1

2021-10-25 07:07:02

by Vinod Koul

Subject: Re: [PATCH] drivers/dma: fix reference count leaks in mmp_pdma_probe

On 11-09-21, 15:05, Xin Xiong wrote:
> The issue happens in an error handling path. If
> of_dma_controller_register() fails, the function simply prints error
> messages and returns error code, without decrementing the reference
> count of pdev->device incremented earlier by
> dma_async_device_register(), which may result in refcount leaks.
>
> Fix it by invoking dma_async_device_unregister() before returning the
> error code.

Pls use right subsystem tag, git log will tell u the same. I have fixe
dit up while applying

--
~Vinod