Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220711005319.2619-1-liubo03@inspur.com>
In-Reply-To: <20220711005319.2619-1-liubo03@inspur.com>
From:   Sergey Ryazanov <ryazanov.s.a@gmail.com>
Date:   Mon, 11 Jul 2022 16:16:08 +0300
Message-ID: <CAHNKnsSoBMDC4P1nFXT+FGDyGYKSinLyhPDCNZ3RdQgkNA9f3Q@mail.gmail.com>
Subject: Re: [PATCH v2 1/1] net: wwan: call ida_free when device_register fails
To:     Bo Liu <liubo03@inspur.com>
Cc:     Loic Poulain <loic.poulain@linaro.org>,
        Johannes Berg <johannes@sipsolutions.net>,
        David Miller <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>, netdev@vger.kernel.org,
        open list <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hello Bo,

generally the patch looks good to me, but it needs improvement in the
wwan_create_dev() part. Sorry that I missed this part in the previous
review. See details below.

On Mon, Jul 11, 2022 at 3:54 AM Bo Liu <liubo03@inspur.com> wrote:
>
> when device_register() fails, we should call ida_free().
>
> Fixes: 9a44c1cc6388 ("net: Add a WWAN subsystem")
> Signed-off-by: Bo Liu <liubo03@inspur.com>
> ---
>  Changes from v1:
>  -Add a Fixes tag pointing to the commit
>
>  drivers/net/wwan/wwan_core.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/wwan/wwan_core.c b/drivers/net/wwan/wwan_core.c
> index b8c7843730ed..0f653e320b2b 100644
> --- a/drivers/net/wwan/wwan_core.c
> +++ b/drivers/net/wwan/wwan_core.c
> @@ -228,8 +228,7 @@ static struct wwan_device *wwan_create_dev(struct device *parent)
>         wwandev = kzalloc(sizeof(*wwandev), GFP_KERNEL);
>         if (!wwandev) {
>                 wwandev = ERR_PTR(-ENOMEM);
> -               ida_free(&wwan_dev_ids, id);
> -               goto done_unlock;
> +               goto error_free_ida;
>         }
>
>         wwandev->dev.parent = parent;
> @@ -242,7 +241,7 @@ static struct wwan_device *wwan_create_dev(struct device *parent)
>         if (err) {
>                 put_device(&wwandev->dev);
>                 wwandev = ERR_PTR(err);
> -               goto done_unlock;
> +               goto error_free_ida;
>         }
>
>  #ifdef CONFIG_WWAN_DEBUGFS
> @@ -251,6 +250,8 @@ static struct wwan_device *wwan_create_dev(struct device *parent)
>                                            wwan_debugfs_dir);
>  #endif
>
> +error_free_ida:
> +       ida_free(&wwan_dev_ids, id);
>  done_unlock:
>         mutex_unlock(&wwan_register_lock);
>

This hunk misses the case of a successful device registration. After
patching, the code will look like this:

    err = device_register(&wwandev->dev);
    if (err) {
        put_device(&wwandev->dev);
        wwandev = ERR_PTR(err);
        goto error_free_ida;
    }

    wwandev->debugfs_dir =
debugfs_create_dir(kobject_name(&wwandev->dev.kobj),
wwan_debugfs_dir);

error_free_ida:
    ida_free(&wwan_dev_ids, id);
done_unlock:
    mutex_unlock(&wwan_register_lock);

As you can see, even if the device will be registered successfully,
the allocated id will be unconditionally freed.

The easiest way to fix this is to add "goto done_unlock" right after
the debugfs directory creation call. So the hunk should become
something like this:

@@ -249,8 +248,12 @@ static struct wwan_device *wwan_create_dev(struct
device *parent)
        wwandev->debugfs_dir =
                     debugfs_create_dir(kobject_name(&wwandev->dev.kobj),
                                           wwan_debugfs_dir);
 #endif

+      goto done_unlock;
+
+error_free_ida:
+       ida_free(&wwan_dev_ids, id);
 done_unlock:
        mutex_unlock(&wwan_register_lock);

-- 
Sergey