Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <bcf4d8db-317f-f0c9-0e9e-5edf25e0c7e8@linux.intel.com>
Date:   Thu, 30 Jun 2022 12:57:51 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Firefox/91.0 Thunderbird/91.8.1
Content-Language: en-US
To:     Jianglei Nie <niejianglei2021@163.com>, mathias.nyman@intel.com,
        gregkh@linuxfoundation.org
Cc:     linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20220630011008.2167298-1-niejianglei2021@163.com>
From:   Mathias Nyman <mathias.nyman@linux.intel.com>
Subject: Re: [PATCH] usb: host: xhci: Fix potential memory leak in
 xhci_alloc_stream_info()
In-Reply-To: <20220630011008.2167298-1-niejianglei2021@163.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 30.6.2022 4.10, Jianglei Nie wrote:
> xhci_alloc_stream_info() allocates stream context array for stream_info
> ->stream_ctx_array with xhci_alloc_stream_ctx(). When some error occurs,
> stream_info->stream_ctx_array is not released, which will lead to a
> memory leak.

Nice catch, thanks

> 
> We can fix it by releasing the stream_info->stream_ctx_array with
> xhci_free_stream_ctx() on the error path to avoid the potential memory
> leak.
> 

Looks like the goto labels were a bit messed up from the beginning.
There are a couple "goto cleanup_ctx" lines in the code, but
cleanup_ctx never freed the ctx.

> Signed-off-by: Jianglei Nie <niejianglei2021@163.com>
> ---
>   drivers/usb/host/xhci-mem.c | 11 ++++++++++-
>   1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
> index 8c19e151a945..a71d3a873467 100644
> --- a/drivers/usb/host/xhci-mem.c
> +++ b/drivers/usb/host/xhci-mem.c
> @@ -648,8 +648,13 @@ struct xhci_stream_info *xhci_alloc_stream_info(struct xhci_hcd *xhci,
>   	/* Allocate everything needed to free the stream rings later */
>   	stream_info->free_streams_command =
>   		xhci_alloc_command_with_ctx(xhci, true, mem_flags);
> -	if (!stream_info->free_streams_command)
> +	if (!stream_info->free_streams_command) {
> +		xhci_free_stream_ctx(xhci,
> +			stream_info->num_stream_ctxs,
> +			stream_info->stream_ctx_array,
> +			stream_info->ctx_array_dma);
>   		goto cleanup_ctx;
> +	}
>   
>   	INIT_RADIX_TREE(&stream_info->trb_address_map, GFP_ATOMIC);
>   
> @@ -700,6 +705,10 @@ struct xhci_stream_info *xhci_alloc_stream_info(struct xhci_hcd *xhci,
>   			stream_info->stream_rings[cur_stream] = NULL;
>   		}
>   	}
> +	xhci_free_stream_ctx(xhci,
> +			stream_info->num_stream_ctxs,
> +			stream_info->stream_ctx_array,
> +			stream_info->ctx_array_dma);
>   	xhci_free_command(xhci, stream_info->free_streams_command);
>   cleanup_ctx:
>   	kfree(stream_info->stream_rings);

How about:

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 8c19e151a945..f7cac1af51c5 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -641,7 +641,7 @@ struct xhci_stream_info *xhci_alloc_stream_info(struct xhci_hcd *xhci,
                         num_stream_ctxs, &stream_info->ctx_array_dma,
                         mem_flags);
         if (!stream_info->stream_ctx_array)
-               goto cleanup_ctx;
+               goto cleanup_rings;
         memset(stream_info->stream_ctx_array, 0,
                         sizeof(struct xhci_stream_ctx)*num_stream_ctxs);
  
@@ -702,6 +702,10 @@ struct xhci_stream_info *xhci_alloc_stream_info(struct xhci_hcd *xhci,
         }
         xhci_free_command(xhci, stream_info->free_streams_command);
  cleanup_ctx:
+       xhci_free_stream_ctx(xhci, stream_info->num_stream_ctxs,
+                            stream_info->stream_ctx_array,
+                            stream_info->ctx_array_dma);
+cleanup_rings:
         kfree(stream_info->stream_rings);
  cleanup_info: