When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), the callback function gp_auxiliary_device_release() calls kfree() to free memory. Do not call kfree() again in the error handling path.
Fix this by skipping the redundant kfree().
Found by code review.
Cc: stable@vger.kernel.org Fixes: 393fc2f5948f ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.") Signed-off-by: Ma Ke make24@iscas.ac.cn --- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c index 32af2b14ff34..fbd712938bdc 100644 --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c @@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
err_aux_dev_add_1: auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev); + goto err_aux_dev_add_0;
err_aux_dev_init_1: ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id); @@ -120,6 +121,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
err_aux_dev_add_0: auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev); + goto err_ret;
err_aux_dev_init_0: ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);
Le 06/01/2025 à 08:40, Ma Ke a écrit :
When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), the callback function gp_auxiliary_device_release() calls kfree() to free memory. Do not call kfree() again in the error handling path.
Fix this by skipping the redundant kfree().
Found by code review.
Cc: stable@vger.kernel.org Fixes: 393fc2f5948f ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.") Signed-off-by: Ma Ke make24@iscas.ac.cn
drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c index 32af2b14ff34..fbd712938bdc 100644 --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c @@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id err_aux_dev_add_1: auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);
- goto err_aux_dev_add_0;
err_aux_dev_init_1: ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id); @@ -120,6 +121,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id err_aux_dev_add_0: auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);
- goto err_ret;
err_aux_dev_init_0: ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);
Hi,
This is strange because the nearly same patch is in -next since June 2024 ([1])
It is also in Linux since at least 6.10 ([2])
In [1] and [2], there is also a new err_ret label, which is not part of your patch.
On which tree are you working? Is your patch compile tested?
CJ
[1]: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/d...
[2]: https://elixir.bootlin.com/linux/v6.10/source/drivers/misc/mchp_pci1xxxx/mch...
Christophe JAILLETchristophe.jaillet@wanadoo.fr wrote:
Ma Ke make24@iscas.ac.cn writes:
When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), the callback function gp_auxiliary_device_release() calls kfree() to free memory. Do not call kfree() again in the error handling path.
Fix this by skipping the redundant kfree().
Found by code review.
Cc: stable@vger.kernel.org Fixes: 393fc2f5948f ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.") Signed-off-by: Ma Ke make24@iscas.ac.cn
drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c index 32af2b14ff34..fbd712938bdc 100644 --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c @@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id err_aux_dev_add_1: auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);
- goto err_aux_dev_add_0;
err_aux_dev_init_1: ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id); @@ -120,6 +121,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id err_aux_dev_add_0: auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);
- goto err_ret;
err_aux_dev_init_0: ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);
Hi,
This is strange because the nearly same patch is in -next since June 2024 ([1])
It is also in Linux since at least 6.10 ([2])
In [1] and [2], there is also a new err_ret label, which is not part of your patch.
On which tree are you working? Is your patch compile tested?
CJ
Thank you for your response. I discovered the aforementioned bug in Linux kernel v6.4.16 (the latest v6.4). It appears that the fix was not completed in the latest version of v6.4. I have also checked the link you mentioned and saw that the issue has been fixed in v6.10. I realize that I omitted the final jump patch in the patch v1 submitted, and I will perfect it in patch v2. Thank you for your suggestion. -- Regards,
Ma Ke
Le 07/01/2025 à 02:19, Ma Ke a écrit :
Christophe JAILLETchristophe.jaillet@wanadoo.fr wrote:
Ma Ke make24@iscas.ac.cn writes:
When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), the callback function gp_auxiliary_device_release() calls kfree() to free memory. Do not call kfree() again in the error handling path.
Fix this by skipping the redundant kfree().
Found by code review.
Cc: stable@vger.kernel.org Fixes: 393fc2f5948f ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.") Signed-off-by: Ma Ke make24@iscas.ac.cn
drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c index 32af2b14ff34..fbd712938bdc 100644 --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c @@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id err_aux_dev_add_1: auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);
- goto err_aux_dev_add_0; err_aux_dev_init_1: ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id);
@@ -120,6 +121,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id err_aux_dev_add_0: auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);
- goto err_ret; err_aux_dev_init_0: ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);
Hi,
This is strange because the nearly same patch is in -next since June 2024 ([1])
It is also in Linux since at least 6.10 ([2])
In [1] and [2], there is also a new err_ret label, which is not part of your patch.
On which tree are you working? Is your patch compile tested?
CJ
Thank you for your response. I discovered the aforementioned bug in Linux kernel v6.4.16 (the latest v6.4). It appears that the fix was not completed in the latest version of v6.4. I have also checked the link you mentioned and saw that the issue has been fixed in v6.10. I realize that I omitted the final jump patch in the patch v1 submitted, and I will perfect it in patch v2. Thank you for your suggestion.
v6.4 is not supported any more, so an updated patch would never be applied. See active branches on https://www.kernel.org/.
Anyway, when don't working on a recent tree, you should tell it, because no one can guess that your patch is related to something old.
I realize that I omitted the final jump
So I guess, that you not compile tested your patch. You should never do that, event when the change looks trivial.
CJ
linux-stable-mirror@lists.linaro.org