2021-08-12 11:52:35

by Evgeny Novikov

Subject: [PATCH] media: pt3: Fix IO unmapping on error handling paths in probe

pt3_probe() did not free one of IO mappings in case when one of them was
successful while another one failed. The patch fixed that.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <[email protected]>
Co-developed-by: Kirill Shilimanov <[email protected]>
Signed-off-by: Kirill Shilimanov <[email protected]>
---
drivers/media/pci/pt3/pt3.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/drivers/media/pci/pt3/pt3.c b/drivers/media/pci/pt3/pt3.c
index c0bc86793355..f1bd2644435b 100644
--- a/drivers/media/pci/pt3/pt3.c
+++ b/drivers/media/pci/pt3/pt3.c
@@ -736,19 +736,24 @@ static int pt3_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
pt3->pdev = pdev;
mutex_init(&pt3->lock);
pt3->regs[0] = pci_ioremap_bar(pdev, 0);
- pt3->regs[1] = pci_ioremap_bar(pdev, 2);
- if (pt3->regs[0] == NULL || pt3->regs[1] == NULL) {
+ if (pt3->regs[0] == NULL) {
dev_err(&pdev->dev, "Failed to ioremap\n");
ret = -ENOMEM;
goto err_kfree;
}
+ pt3->regs[1] = pci_ioremap_bar(pdev, 2);
+ if (pt3->regs[1] == NULL) {
+ dev_err(&pdev->dev, "Failed to ioremap\n");
+ ret = -ENOMEM;
+ goto err_iounmap0;
+ }

ver = ioread32(pt3->regs[0] + REG_VERSION);
if ((ver >> 16) != 0x0301) {
dev_warn(&pdev->dev, "PT%d, I/F-ver.:%d not supported\n",
ver >> 24, (ver & 0x00ff0000) >> 16);
ret = -ENODEV;
- goto err_iounmap;
+ goto err_iounmap1;
}

pt3->num_bufs = clamp_val(num_bufs, MIN_DATA_BUFS, MAX_DATA_BUFS);
@@ -756,7 +761,7 @@ static int pt3_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
pt3->i2c_buf = kmalloc(sizeof(*pt3->i2c_buf), GFP_KERNEL);
if (pt3->i2c_buf == NULL) {
ret = -ENOMEM;
- goto err_iounmap;
+ goto err_iounmap1;
}
i2c = &pt3->i2c_adap;
i2c->owner = THIS_MODULE;
@@ -801,11 +806,12 @@ static int pt3_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
i2c_del_adapter(i2c);
err_i2cbuf:
kfree(pt3->i2c_buf);
-err_iounmap:
- if (pt3->regs[0])
- pci_iounmap(pdev, pt3->regs[0]);
+err_iounmap1:
if (pt3->regs[1])
pci_iounmap(pdev, pt3->regs[1]);
+err_iounmap0:
+ if (pt3->regs[0])
+ pci_iounmap(pdev, pt3->regs[0]);
err_kfree:
kfree(pt3);
err_release_regions:
--
2.26.2

2021-08-14 15:45:24

by Evgeny Novikov

Subject: Re: [PATCH] media: pt3: Fix IO unmapping on error handling paths in probe

Hi Andy,

On 12.08.2021 15:08, Andy Shevchenko wrote:
>
>
> On Thursday, August 12, 2021, Evgeny Novikov <[email protected]
> <mailto:[email protected]>> wrote:
>
> pt3_probe() did not free one of IO mappings in case when one of
> them was
> successful while another one failed. The patch fixed that.
>
>
>
> It makes code not better, what really may do is a conversion to
> pcim_*() and devm_*() APIs.
Thank you for the good suggestion. I will resend the patch. But you
should take into account, that I have not an ability to test upcoming
changes except for compiling them and checking some requirement
specifications included into our verification framework. So, further
work and decisions are up to driver developers.

Best regards,
Evgeny Novikov
>
>
> Found by Linux Driver Verification project (linuxtesting.org
> <http://linuxtesting.org>).
>
> Signed-off-by: Evgeny Novikov <[email protected]
> <mailto:[email protected]>>
> Co-developed-by: Kirill Shilimanov <[email protected]
> <mailto:[email protected]>>
> Signed-off-by: Kirill Shilimanov <[email protected]
> <mailto:[email protected]>>
> ---
>  drivers/media/pci/pt3/pt3.c | 20 +++++++++++++-------
>  1 file changed, 13 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/media/pci/pt3/pt3.c b/drivers/media/pci/pt3/pt3.c
> index c0bc86793355..f1bd2644435b 100644
> --- a/drivers/media/pci/pt3/pt3.c
> +++ b/drivers/media/pci/pt3/pt3.c
> @@ -736,19 +736,24 @@ static int pt3_probe(struct pci_dev *pdev,
> const struct pci_device_id *ent)
>         pt3->pdev = pdev;
>         mutex_init(&pt3->lock);
>         pt3->regs[0] = pci_ioremap_bar(pdev, 0);
> -       pt3->regs[1] = pci_ioremap_bar(pdev, 2);
> -       if (pt3->regs[0] == NULL || pt3->regs[1] == NULL) {
> +       if (pt3->regs[0] == NULL) {
>                 dev_err(&pdev->dev, "Failed to ioremap\n");
>                 ret = -ENOMEM;
>                 goto err_kfree;
>         }
> +       pt3->regs[1] = pci_ioremap_bar(pdev, 2);
> +       if (pt3->regs[1] == NULL) {
> +               dev_err(&pdev->dev, "Failed to ioremap\n");
> +               ret = -ENOMEM;
> +               goto err_iounmap0;
> +       }
>
>         ver = ioread32(pt3->regs[0] + REG_VERSION);
>         if ((ver >> 16) != 0x0301) {
>                 dev_warn(&pdev->dev, "PT%d, I/F-ver.:%d not
> supported\n",
>                          ver >> 24, (ver & 0x00ff0000) >> 16);
>                 ret = -ENODEV;
> -               goto err_iounmap;
> +               goto err_iounmap1;
>         }
>
>         pt3->num_bufs = clamp_val(num_bufs, MIN_DATA_BUFS,
> MAX_DATA_BUFS);
> @@ -756,7 +761,7 @@ static int pt3_probe(struct pci_dev *pdev,
> const struct pci_device_id *ent)
>         pt3->i2c_buf = kmalloc(sizeof(*pt3->i2c_buf), GFP_KERNEL);
>         if (pt3->i2c_buf == NULL) {
>                 ret = -ENOMEM;
> -               goto err_iounmap;
> +               goto err_iounmap1;
>         }
>         i2c = &pt3->i2c_adap;
>         i2c->owner = THIS_MODULE;
> @@ -801,11 +806,12 @@ static int pt3_probe(struct pci_dev *pdev,
> const struct pci_device_id *ent)
>         i2c_del_adapter(i2c);
>  err_i2cbuf:
>         kfree(pt3->i2c_buf);
> -err_iounmap:
> -       if (pt3->regs[0])
> -               pci_iounmap(pdev, pt3->regs[0]);
> +err_iounmap1:
>         if (pt3->regs[1])
>                 pci_iounmap(pdev, pt3->regs[1]);
> +err_iounmap0:
> +       if (pt3->regs[0])
> +               pci_iounmap(pdev, pt3->regs[0]);
>  err_kfree:
>         kfree(pt3);
>  err_release_regions:
> --
> 2.26.2
>
>
>
> --
> With Best Regards,
> Andy Shevchenko
>
>