2024-02-27 21:32:20

by Christophe JAILLET

[permalink] [raw]
Subject: [PATCH net 0/2] net: tehuti: Fix some error handling paths in bdx_probe()

The patch has been split in 2 patches in the hope to ease review. But
they both fix issues introduced years ago in the same commit.

Moreover, the 2nd patch partly undoes the first one.

So, if preferred they can be merged in a single patch.

They are both compile tested-only.

Christophe JAILLET (2):
net: tehuti: Fix a missing pci_disable_msi() in the error handling
path of bdx_probe()
net: tehuti: Fix leaks in the error handling path of bdx_probe()

drivers/net/ethernet/tehuti/tehuti.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)

--
2.43.2



2024-02-27 21:35:58

by Christophe JAILLET

[permalink] [raw]
Subject: [PATCH net 2/2] net: tehuti: Fix leaks in the error handling path of bdx_probe()

If an error occurs when allocating the net_device, all the one already
allocated and registered should be released, as already done in the remove
function.

Add a new label, remove the now useless 'err_out_disable_msi' label and
adjust the error handling path accordingly.

Fixes: 1a348ccc1047 ("[NET]: Add Tehuti network driver.")
Signed-off-by: Christophe JAILLET <[email protected]>
---
Compile tested only.
---
drivers/net/ethernet/tehuti/tehuti.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index 938a5caf5a3b..6678179885cb 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -1965,7 +1965,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
ndev = alloc_etherdev(sizeof(struct bdx_priv));
if (!ndev) {
err = -ENOMEM;
- goto err_out_disable_msi;
+ goto err_out_free;
}

ndev->netdev_ops = &bdx_netdev_ops;
@@ -2031,13 +2031,13 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
if (bdx_read_mac(priv)) {
pr_err("load MAC address failed\n");
err = -EFAULT;
- goto err_out_disable_msi;
+ goto err_out_free_current;
}
SET_NETDEV_DEV(ndev, &pdev->dev);
err = register_netdev(ndev);
if (err) {
pr_err("register_netdev failed\n");
- goto err_out_free;
+ goto err_out_free_current;
}
netif_carrier_off(ndev);
netif_stop_queue(ndev);
@@ -2046,9 +2046,14 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
}
RET(0);

-err_out_free:
+err_out_free_current:
free_netdev(ndev);
-err_out_disable_msi:
+err_out_free:
+ while (--port >= 0) {
+ ndev = nic->priv[port]->ndev;
+ unregister_netdev(ndev);
+ free_netdev(ndev);
+ }
#ifdef BDX_MSI
if (nic->irq_type == IRQ_MSI)
pci_disable_msi(pdev);
--
2.43.2


2024-02-28 10:17:39

by Dan Carpenter

[permalink] [raw]
Subject: Re: [PATCH net 2/2] net: tehuti: Fix leaks in the error handling path of bdx_probe()

On Tue, Feb 27, 2024 at 09:50:56PM +0100, Christophe JAILLET wrote:
> If an error occurs when allocating the net_device, all the one already
> allocated and registered should be released, as already done in the remove
> function.
>
> Add a new label, remove the now useless 'err_out_disable_msi' label and
> adjust the error handling path accordingly.
>
> Fixes: 1a348ccc1047 ("[NET]: Add Tehuti network driver.")
> Signed-off-by: Christophe JAILLET <[email protected]>
> ---
> Compile tested only.
> ---
> drivers/net/ethernet/tehuti/tehuti.c | 15 ++++++++++-----
> 1 file changed, 10 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
> index 938a5caf5a3b..6678179885cb 100644
> --- a/drivers/net/ethernet/tehuti/tehuti.c
> +++ b/drivers/net/ethernet/tehuti/tehuti.c
> @@ -1965,7 +1965,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
> ndev = alloc_etherdev(sizeof(struct bdx_priv));
> if (!ndev) {
> err = -ENOMEM;
> - goto err_out_disable_msi;
> + goto err_out_free;
> }
>
> ndev->netdev_ops = &bdx_netdev_ops;
> @@ -2031,13 +2031,13 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
> if (bdx_read_mac(priv)) {
> pr_err("load MAC address failed\n");
> err = -EFAULT;
> - goto err_out_disable_msi;
> + goto err_out_free_current;
> }
> SET_NETDEV_DEV(ndev, &pdev->dev);
> err = register_netdev(ndev);
> if (err) {
> pr_err("register_netdev failed\n");
> - goto err_out_free;
> + goto err_out_free_current;
> }
> netif_carrier_off(ndev);
> netif_stop_queue(ndev);
> @@ -2046,9 +2046,14 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
> }
> RET(0);
>
> -err_out_free:
> +err_out_free_current:
> free_netdev(ndev);

Since it seems like you're going to be resending this patch, could you
do this free_netdev() before gotos? That way if someone adds more code
after the loop then we can still use the goto ladder to unwind. (No one
is going to add more code after the loop, I know... I wouldn't have
commented except that it seemed like you were going to resend.)

if (bdx_read_mac(priv)) {
free_netdev(ndev);
pr_err("load MAC address failed\n");
err = -EFAULT;
goto err_out_free;
}

regards,
dan carpenter



2024-02-28 10:25:12

by Jiri Pirko

[permalink] [raw]
Subject: Re: [PATCH net 2/2] net: tehuti: Fix leaks in the error handling path of bdx_probe()

Tue, Feb 27, 2024 at 09:50:56PM CET, [email protected] wrote:
>If an error occurs when allocating the net_device, all the one already
>allocated and registered should be released, as already done in the remove
>function.
>
>Add a new label, remove the now useless 'err_out_disable_msi' label and
>adjust the error handling path accordingly.
>
>Fixes: 1a348ccc1047 ("[NET]: Add Tehuti network driver.")
>Signed-off-by: Christophe JAILLET <[email protected]>
>---
>Compile tested only.


Looks okay.

Reviewed-by: Jiri Pirko <[email protected]>

2024-02-28 18:02:42

by Christophe JAILLET

[permalink] [raw]
Subject: Re: [PATCH net 2/2] net: tehuti: Fix leaks in the error handling path of bdx_probe()

Le 28/02/2024 à 11:17, Dan Carpenter a écrit :
> On Tue, Feb 27, 2024 at 09:50:56PM +0100, Christophe JAILLET wrote:
>> If an error occurs when allocating the net_device, all the one already
>> allocated and registered should be released, as already done in the remove
>> function.
>>
>> Add a new label, remove the now useless 'err_out_disable_msi' label and
>> adjust the error handling path accordingly.
>>
>> Fixes: 1a348ccc1047 ("[NET]: Add Tehuti network driver.")
>> Signed-off-by: Christophe JAILLET <[email protected]>
>> ---
>> Compile tested only.
>> ---
>> drivers/net/ethernet/tehuti/tehuti.c | 15 ++++++++++-----
>> 1 file changed, 10 insertions(+), 5 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
>> index 938a5caf5a3b..6678179885cb 100644
>> --- a/drivers/net/ethernet/tehuti/tehuti.c
>> +++ b/drivers/net/ethernet/tehuti/tehuti.c
>> @@ -1965,7 +1965,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>> ndev = alloc_etherdev(sizeof(struct bdx_priv));
>> if (!ndev) {
>> err = -ENOMEM;
>> - goto err_out_disable_msi;
>> + goto err_out_free;
>> }
>>
>> ndev->netdev_ops = &bdx_netdev_ops;
>> @@ -2031,13 +2031,13 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>> if (bdx_read_mac(priv)) {
>> pr_err("load MAC address failed\n");
>> err = -EFAULT;
>> - goto err_out_disable_msi;
>> + goto err_out_free_current;
>> }
>> SET_NETDEV_DEV(ndev, &pdev->dev);
>> err = register_netdev(ndev);
>> if (err) {
>> pr_err("register_netdev failed\n");
>> - goto err_out_free;
>> + goto err_out_free_current;
>> }
>> netif_carrier_off(ndev);
>> netif_stop_queue(ndev);
>> @@ -2046,9 +2046,14 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>> }
>> RET(0);
>>
>> -err_out_free:
>> +err_out_free_current:
>> free_netdev(ndev);
>
> Since it seems like you're going to be resending this patch, could you
> do this free_netdev() before gotos? That way if someone adds more code
> after the loop then we can still use the goto ladder to unwind. (No one
> is going to add more code after the loop, I know... I wouldn't have
> commented except that it seemed like you were going to resend.)
>
> if (bdx_read_mac(priv)) {
> free_netdev(ndev);
> pr_err("load MAC address failed\n");
> err = -EFAULT;
> goto err_out_free;
> }
>

Yeh, I thought about it, but it is more verbose and this code looks
mostly unchanged since 2007!

Anyway, I agree with you and will update accordingly.

CJ

> regards,
> dan carpenter
>
>
>
>