In yenta_probe(), an irq leak potentially happens when
pcmcia_register_socket() fails. I added the missed call.
Signed-off-by: Takeshi Yoshimura <[email protected]>
---
drivers/pcmcia/yenta_socket.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index 965bd84..7922e30f 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -1269,6 +1269,8 @@ static int yenta_probe(struct pci_dev *dev, const struct pci_device_id *id)
pcmcia_unregister_socket(&socket->socket);
}
+ if (socket->cb_irq)
+ free_irq(socket->irq, socket);
unmap:
iounmap(socket->base);
release:
--
1.9.1
Hi Takeshi,
On Sun, Jun 14, 2015 at 09:14:41PM +0900, Takeshi Yoshimura wrote:
> In yenta_probe(), an irq leak potentially happens when
> pcmcia_register_socket() fails. I added the missed call.
nice catch, many thanks.
> index 965bd84..7922e30f 100644
> --- a/drivers/pcmcia/yenta_socket.c
> +++ b/drivers/pcmcia/yenta_socket.c
> @@ -1269,6 +1269,8 @@ static int yenta_probe(struct pci_dev *dev, const struct pci_device_id *id)
> pcmcia_unregister_socket(&socket->socket);
> }
>
> + if (socket->cb_irq)
> + free_irq(socket->irq, socket);
> unmap:
> iounmap(socket->base);
> release:
However, this should also handle the case for sock->cb_irq being zero,
like it is done in yenta_close.
Furthermore, when comparing yenta_close and this error path in yenta_probe(),
I noticed a few other issues:
- yenta_free_resources() is not called in yenta_probe()
- pci_set_drvdata(dev, NULL) and kfree(socket) are not called in yenta_probe()
- sock->base is always set to non-NULL when yenta_close() is called,
therefore the check in yenta_close() may be removed.
Would you be willing to update your patch to address also these issues?
Then, I'll happily push it upstream.
Best,
Dominik
Hi,
>> index 965bd84..7922e30f 100644
>> --- a/drivers/pcmcia/yenta_socket.c
>> +++ b/drivers/pcmcia/yenta_socket.c
>> @@ -1269,6 +1269,8 @@ static int yenta_probe(struct pci_dev *dev, const struct pci_device_id *id)
>> pcmcia_unregister_socket(&socket->socket);
>> }
>>
>> + if (socket->cb_irq)
>> + free_irq(socket->irq, socket);
>> unmap:
>> iounmap(socket->base);
>> release:
Oops, I noticed the fixed code was not compilable. Sorry for that.
>
> However, this should also handle the case for sock->cb_irq being zero,
> like it is done in yenta_close.
>
> Furthermore, when comparing yenta_close and this error path in yenta_probe(),
> I noticed a few other issues:
> - yenta_free_resources() is not called in yenta_probe()
> - pci_set_drvdata(dev, NULL) and kfree(socket) are not called in yenta_probe()
> - sock->base is always set to non-NULL when yenta_close() is called,
> therefore the check in yenta_close() may be removed.
>
Thanks for many suggestions. But, it looks like yenta_probe() called kfree()
appropriately. I guess you meant to kfree() is not called in yenta_close().
> Would you be willing to update your patch to address also these issues?
> Then, I'll happily push it upstream.
>
Sure. I'll send the updated patch in another mail.
Regards,
Takeshi Yoshimura