Hi, back from Rome, I suppose ;).
On 02/19/2013 06:57 AM, Alexey Khoroshilov wrote:
> 1. Currently mxser_probe() and mxser_module_init() ignore errors
> that can happen in tty_port_register_device().
> 2. mxser_module_init() does not deallocate resources allocated in mxser_get_ISA_conf()
> if mxser_initbrd() failed.
>
> The patch adds proper error handling in all the cases.
> Also it moves free_irq() from mxser_release_ISA_res() to mxser_board_remove(),
> since it makes mxser_release_ISA_res() a counterpart for mxser_get_ISA_conf(),
> while free_irq() is relevant to both ISA and PCI boards.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Alexey Khoroshilov <[email protected]>
> ---
> drivers/tty/mxser.c | 42 +++++++++++++++++++++++++++++++++++-------
> 1 file changed, 35 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
> index 4011386..deeb5ad 100644
> --- a/drivers/tty/mxser.c
> +++ b/drivers/tty/mxser.c
> @@ -2364,7 +2364,6 @@ static void mxser_release_vector(struct mxser_board *brd)
>
> static void mxser_release_ISA_res(struct mxser_board *brd)
> {
> - free_irq(brd->irq, brd);
> release_region(brd->ports[0].ioaddr, 8 * brd->info->nports);
> mxser_release_vector(brd);
> }
> @@ -2430,6 +2429,7 @@ static void mxser_board_remove(struct mxser_board *brd)
> tty_unregister_device(mxvar_sdriver, brd->idx + i);
> tty_port_destroy(&brd->ports[i].port);
> }
> + free_irq(brd->irq, brd);
> }
>
> static int __init mxser_get_ISA_conf(int cap, struct mxser_board *brd)
> @@ -2554,6 +2554,7 @@ static int mxser_probe(struct pci_dev *pdev,
> struct mxser_board *brd;
> unsigned int i, j;
> unsigned long ioaddress;
> + struct device *tty_dev;
> int retval = -EINVAL;
>
> for (i = 0; i < MXSER_BOARDS; i++)
> @@ -2637,13 +2638,25 @@ static int mxser_probe(struct pci_dev *pdev,
> if (retval)
> goto err_rel3;
>
> - for (i = 0; i < brd->info->nports; i++)
> - tty_port_register_device(&brd->ports[i].port, mxvar_sdriver,
> - brd->idx + i, &pdev->dev);
> + for (i = 0; i < brd->info->nports; i++) {
> + tty_dev = tty_port_register_device(&brd->ports[i].port,
> + mxvar_sdriver, brd->idx + i, &pdev->dev);
> + if (IS_ERR(tty_dev)) {
> + retval = PTR_ERR(tty_dev);
> + for (; i > 0; i--)
To me, it seems that v1 of the patch was merged. Could you fix this up?
[Coverity revealed this.]
thanks,
--
js
suse labs
There is a bug in resources deallocation code in mxser_probe() and mxser_module_init().
As soon as variable 'i' is unsigned int, cycle termination condition i >= 0 is always true.
The patch fixes the issue.
Signed-off-by: Alexey Khoroshilov <[email protected]>
---
drivers/tty/mxser.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
index 484b6a3..302909c 100644
--- a/drivers/tty/mxser.c
+++ b/drivers/tty/mxser.c
@@ -2643,9 +2643,9 @@ static int mxser_probe(struct pci_dev *pdev,
mxvar_sdriver, brd->idx + i, &pdev->dev);
if (IS_ERR(tty_dev)) {
retval = PTR_ERR(tty_dev);
- for (i--; i >= 0; i--)
+ for (; i > 0; i--)
tty_unregister_device(mxvar_sdriver,
- brd->idx + i);
+ brd->idx + i - 1);
goto err_relbrd;
}
}
@@ -2751,9 +2751,9 @@ static int __init mxser_module_init(void)
tty_dev = tty_port_register_device(&brd->ports[i].port,
mxvar_sdriver, brd->idx + i, NULL);
if (IS_ERR(tty_dev)) {
- for (i--; i >= 0; i--)
+ for (; i > 0; i--)
tty_unregister_device(mxvar_sdriver,
- brd->idx + i);
+ brd->idx + i - 1);
for (i = 0; i < brd->info->nports; i++)
tty_port_destroy(&brd->ports[i].port);
free_irq(brd->irq, brd);
--
1.7.9.5
On 04/07/2013 09:46 PM, Alexey Khoroshilov wrote:
> There is a bug in resources deallocation code in mxser_probe() and mxser_module_init().
> As soon as variable 'i' is unsigned int, cycle termination condition i >= 0 is always true.
> The patch fixes the issue.
>
> Signed-off-by: Alexey Khoroshilov <[email protected]>
Yes, thanks.
Acked-by: Jiri Slaby <[email protected]>
> ---
> drivers/tty/mxser.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
> index 484b6a3..302909c 100644
> --- a/drivers/tty/mxser.c
> +++ b/drivers/tty/mxser.c
> @@ -2643,9 +2643,9 @@ static int mxser_probe(struct pci_dev *pdev,
> mxvar_sdriver, brd->idx + i, &pdev->dev);
> if (IS_ERR(tty_dev)) {
> retval = PTR_ERR(tty_dev);
> - for (i--; i >= 0; i--)
> + for (; i > 0; i--)
> tty_unregister_device(mxvar_sdriver,
> - brd->idx + i);
> + brd->idx + i - 1);
> goto err_relbrd;
> }
> }
> @@ -2751,9 +2751,9 @@ static int __init mxser_module_init(void)
> tty_dev = tty_port_register_device(&brd->ports[i].port,
> mxvar_sdriver, brd->idx + i, NULL);
> if (IS_ERR(tty_dev)) {
> - for (i--; i >= 0; i--)
> + for (; i > 0; i--)
> tty_unregister_device(mxvar_sdriver,
> - brd->idx + i);
> + brd->idx + i - 1);
> for (i = 0; i < brd->info->nports; i++)
> tty_port_destroy(&brd->ports[i].port);
> free_irq(brd->irq, brd);
>
--
js
suse labs