Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756558AbaGEMeh (ORCPT ); Sat, 5 Jul 2014 08:34:37 -0400 Received: from mail-ob0-f173.google.com ([209.85.214.173]:33108 "EHLO mail-ob0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751120AbaGEMed (ORCPT ); Sat, 5 Jul 2014 08:34:33 -0400 MIME-Version: 1.0 In-Reply-To: <20140704172457.GA3404@lianli> References: <1404418756-10550-1-git-send-email-rickard_strandqvist@spectrumdigital.se> <1404418756-10550-2-git-send-email-rickard_strandqvist@spectrumdigital.se> <20140704091000.GA4738@lianli> <20140704172457.GA3404@lianli> Date: Sat, 5 Jul 2014 14:34:33 +0200 Message-ID: Subject: Re: [PATCH v3] i2c: busses: i2c-pxa.c: Fix for possible null pointer dereferenc From: Rickard Strandqvist To: Emil Goode Cc: Wolfram Sang , Grant Likely , Rob Herring , Jingoo Han , Leilei Shang , Peter Korsgaard , linux-i2c@vger.kernel.org, "linux-kernel@vger.kernel.org" , "devicetree@vger.kernel.org" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2014-07-04 19:24 GMT+02:00 Emil Goode : > Hello, > > I noticed one more thing. > > On Fri, Jul 04, 2014 at 07:07:48PM +0200, Rickard Strandqvist wrote: >> 2014-07-04 11:10 GMT+02:00 Emil Goode : >> > Hello Rickard, >> > >> > Since this is a probe function there is also no need to release the devm_* >> > resources in the i2c_pxa_remove function, this leads to double free. >> > >> > Also I have a few nit-pick comments below. >> > >> > On Thu, Jul 03, 2014 at 10:19:16PM +0200, Rickard Strandqvist wrote: >> >> Fix for possible null pointer dereferenc, and there is a risk for memory leak if something unexpected happens and the function returns. >> >> It now use Managed Device Resource instead. >> >> >> >> Signed-off-by: Rickard Strandqvist >> >> --- >> >> drivers/i2c/busses/i2c-pxa.c | 37 ++++++++++++++++--------------------- >> >> 1 file changed, 16 insertions(+), 21 deletions(-) >> >> >> >> diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c >> >> index be671f7..2edb633 100644 >> >> --- a/drivers/i2c/busses/i2c-pxa.c >> >> +++ b/drivers/i2c/busses/i2c-pxa.c >> >> @@ -1141,10 +1141,10 @@ static int i2c_pxa_probe(struct platform_device *dev) >> >> struct resource *res = NULL; >> >> int ret, irq; >> >> >> >> - i2c = kzalloc(sizeof(struct pxa_i2c), GFP_KERNEL); >> >> + i2c = devm_kzalloc(&dev->dev, sizeof(struct pxa_i2c), GFP_KERNEL); >> >> if (!i2c) { >> >> ret = -ENOMEM; >> >> - goto emalloc; >> >> + goto err_nothing_to_release; >> > >> > Perhaps its a good idea to return directly here, then the label >> > err_nothing_to_release can be removed. >> > >> >> } >> >> >> >> /* Default adapter num to device id; i2c_pxa_probe_dt can override. */ >> >> @@ -1154,18 +1154,19 @@ static int i2c_pxa_probe(struct platform_device *dev) >> >> if (ret > 0) >> >> ret = i2c_pxa_probe_pdata(dev, i2c, &i2c_type); >> >> if (ret < 0) >> >> - goto eclk; >> >> + goto err_nothing_to_release; >> > >> > Same here. >> > >> >> >> >> res = platform_get_resource(dev, IORESOURCE_MEM, 0); >> >> irq = platform_get_irq(dev, 0); >> >> if (res == NULL || irq < 0) { >> >> ret = -ENODEV; >> >> - goto eclk; >> >> + goto err_nothing_to_release; >> > >> > Same here. >> > >> >> } >> >> >> >> - if (!request_mem_region(res->start, resource_size(res), res->name)) { >> >> + if (!devm_request_mem_region(&dev->dev, res->start, >> >> + resource_size(res), res->name)) { >> >> ret = -ENOMEM; >> >> - goto eclk; >> >> + goto emalloc; >> > >> > We could also return directly here since the release_mem_region call should >> > be removed, as mentioned in Jingoos reply. >> > >> >> } >> >> >> >> i2c->adap.owner = THIS_MODULE; >> >> @@ -1176,16 +1177,16 @@ static int i2c_pxa_probe(struct platform_device *dev) >> >> >> >> strlcpy(i2c->adap.name, "pxa_i2c-i2c", sizeof(i2c->adap.name)); >> >> >> >> - i2c->clk = clk_get(&dev->dev, NULL); >> >> + i2c->clk = devm_clk_get(&dev->dev, NULL); >> >> if (IS_ERR(i2c->clk)) { >> >> ret = PTR_ERR(i2c->clk); >> >> - goto eclk; >> >> + goto emalloc; >> > >> > Same here. >> > >> >> } >> >> >> >> - i2c->reg_base = ioremap(res->start, resource_size(res)); >> >> - if (!i2c->reg_base) { >> >> + i2c->reg_base = devm_ioremap_resource(&adev->dev, res)); >> >> + if (IS_ERR(i2c->reg_base)) { >> >> ret = -EIO; >> >> - goto eremap; >> >> + goto emalloc; >> > >> > Same here. >> > >> >> } >> >> >> >> i2c->reg_ibmr = i2c->reg_base + pxa_reg_layout[i2c_type].ibmr; >> >> @@ -1227,10 +1228,10 @@ static int i2c_pxa_probe(struct platform_device *dev) >> >> i2c->adap.algo = &i2c_pxa_pio_algorithm; >> >> } else { >> >> i2c->adap.algo = &i2c_pxa_algorithm; >> >> - ret = request_irq(irq, i2c_pxa_handler, IRQF_SHARED, >> >> - dev_name(&dev->dev), i2c); >> >> + ret = devm_request_irq(&dev->dev, irq, i2c_pxa_handler, >> >> + IRQF_SHARED, dev_name(&dev->dev), i2c); >> >> if (ret) >> >> - goto ereqirq; >> >> + goto emalloc; >> > >> > Same here. >> > >> >> } >> >> >> >> i2c_pxa_reset(i2c); >> >> @@ -1261,15 +1262,9 @@ static int i2c_pxa_probe(struct platform_device *dev) >> >> eadapt: >> >> if (!i2c->use_pio) >> >> free_irq(irq, i2c); >> > >> > The free_irq() call should also be removed since devm_request_irq() was used. >> > >> >> -ereqirq: >> >> - clk_disable_unprepare(i2c->clk); > > I think we should keep the clk_disable_unprepare() call. > >> >> - iounmap(i2c->reg_base); >> >> -eremap: >> >> - clk_put(i2c->clk); >> >> -eclk: >> >> - kfree(i2c); >> >> emalloc: >> >> release_mem_region(res->start, resource_size(res)); >> >> +err_nothing_to_release: >> >> return ret; >> >> } >> >> >> > >> > Best regards, >> > >> > Emil Goode >> >> Hi All! >> >> Ok, so there is literally nothing to do release anymore. >> A good system Devres, I understand you want everyone to use it. >> >> I also think it is also better to return directly then. >> But who decides, Wolfram? > > Yes, Wolfram is the maintainer. > > Personally I would do the devm_* convertion in a second patch. Hi Ok then, Wolfram! Keep only: ereqirq: clk_disable_unprepare(i2c->clk); And let everyone else just return? And Emil, as I said before, it would in that case the first patch just be: emalloc: - release_mem_region(res->start, resource_size(res)); + if(res) + release_mem_region(res->start, resource_size(res)); It is rather pointless to add something in a patch, to remove it in the next. Kind regards Rickard Strandqvist -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/