From nobody Fri Apr 3 02:23:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39F85C6FA86 for ; Sun, 18 Sep 2022 06:27:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229484AbiIRG1g (ORCPT ); Sun, 18 Sep 2022 02:27:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48040 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229511AbiIRG1a (ORCPT ); Sun, 18 Sep 2022 02:27:30 -0400 Received: from smtp.smtpout.orange.fr (smtp-13.smtpout.orange.fr [80.12.242.13]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C9DD125EAD for ; Sat, 17 Sep 2022 23:27:28 -0700 (PDT) Received: from pop-os.home ([90.11.190.129]) by smtp.orange.fr with ESMTPA id Znm1oh1YIBDYDZnm1ofRWp; Sun, 18 Sep 2022 08:27:27 +0200 X-ME-Helo: pop-os.home X-ME-Auth: Y2hyaXN0b3BoZS5qYWlsbGV0QHdhbmFkb28uZnI= X-ME-Date: Sun, 18 Sep 2022 08:27:27 +0200 X-ME-IP: 90.11.190.129 From: Christophe JAILLET To: Kumaravel Thiagarajan , Arnd Bergmann , Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Christophe JAILLET , linux-gpio@vger.kernel.org Subject: [PATCH 1/3] misc: microchip: pci1xxxx: Do not disable the pci device twice in gp_aux_bus_remove() Date: Sun, 18 Sep 2022 08:27:24 +0200 Message-Id: <8a3a385b3ae15ee7497469ec3250302b626a018b.1663482259.git.christophe.jaillet@wanadoo.fr> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" gp_aux_bus_probe() uses pcim_enable_device(), so there is no point in calling pci_disable_device() explicitly in the remove function. Fixes: 393fc2f5948f ("misc: microchip: pci1xxxx: load auxiliary bus driver = for the PIO function in the multi-function endpoint of pci1xxxx device.") Signed-off-by: Christophe JAILLET --- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c b/drivers/misc/m= chp_pci1xxxx/mchp_pci1xxxx_gp.c index edff3ee73f6f..6c4f8384aa09 100644 --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c @@ -139,7 +139,6 @@ static void gp_aux_bus_remove(struct pci_dev *pdev) auxiliary_device_delete(&aux_bus->aux_device_wrapper[1]->aux_dev); auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev); kfree(aux_bus); - pci_disable_device(pdev); } =20 static const struct pci_device_id pci1xxxx_tbl[] =3D { --=20 2.34.1 From nobody Fri Apr 3 02:23:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4671C32771 for ; Sun, 18 Sep 2022 06:27:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229524AbiIRG1o (ORCPT ); Sun, 18 Sep 2022 02:27:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229457AbiIRG1i (ORCPT ); Sun, 18 Sep 2022 02:27:38 -0400 Received: from smtp.smtpout.orange.fr (smtp06.smtpout.orange.fr [80.12.242.128]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0916125E87 for ; Sat, 17 Sep 2022 23:27:38 -0700 (PDT) Received: from pop-os.home ([90.11.190.129]) by smtp.orange.fr with ESMTPA id ZnmAoJp3fTyouZnmAoYlTc; Sun, 18 Sep 2022 08:27:36 +0200 X-ME-Helo: pop-os.home X-ME-Auth: Y2hyaXN0b3BoZS5qYWlsbGV0QHdhbmFkb28uZnI= X-ME-Date: Sun, 18 Sep 2022 08:27:36 +0200 X-ME-IP: 90.11.190.129 From: Christophe JAILLET To: Kumaravel Thiagarajan , Arnd Bergmann , Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Christophe JAILLET , linux-gpio@vger.kernel.org Subject: [PATCH 2/3] misc: microchip: pci1xxxx: Fix a memory leak in the error handling of gp_aux_bus_probe() Date: Sun, 18 Sep 2022 08:27:33 +0200 Message-Id: <17e19926669a1654e5f2495bf3b289581183d02e.1663482259.git.christophe.jaillet@wanadoo.fr> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" 'aux_bus' is freed in the remove function but not in the error handling path of the probe. Use devm_kzalloc() to simplify the remove function and fix the leak in the probe. Fixes: 393fc2f5948f ("misc: microchip: pci1xxxx: load auxiliary bus driver = for the PIO function in the multi-function endpoint of pci1xxxx device.") Signed-off-by: Christophe JAILLET --- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c b/drivers/misc/m= chp_pci1xxxx/mchp_pci1xxxx_gp.c index 6c4f8384aa09..32af2b14ff34 100644 --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c @@ -38,7 +38,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const s= truct pci_device_id *id if (retval) return retval; =20 - aux_bus =3D kzalloc(sizeof(*aux_bus), GFP_KERNEL); + aux_bus =3D devm_kzalloc(&pdev->dev, sizeof(*aux_bus), GFP_KERNEL); if (!aux_bus) return -ENOMEM; =20 @@ -138,7 +138,6 @@ static void gp_aux_bus_remove(struct pci_dev *pdev) auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev); auxiliary_device_delete(&aux_bus->aux_device_wrapper[1]->aux_dev); auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev); - kfree(aux_bus); } =20 static const struct pci_device_id pci1xxxx_tbl[] =3D { --=20 2.34.1 From nobody Fri Apr 3 02:23:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3614C32771 for ; Sun, 18 Sep 2022 06:28:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229566AbiIRG2B (ORCPT ); Sun, 18 Sep 2022 02:28:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48430 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229447AbiIRG1u (ORCPT ); Sun, 18 Sep 2022 02:27:50 -0400 Received: from smtp.smtpout.orange.fr (smtp04.smtpout.orange.fr [80.12.242.126]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3DB5D2611F for ; Sat, 17 Sep 2022 23:27:47 -0700 (PDT) Received: from pop-os.home ([90.11.190.129]) by smtp.orange.fr with ESMTPA id ZnmJo9OZsAOp2ZnmJoqqJY; Sun, 18 Sep 2022 08:27:45 +0200 X-ME-Helo: pop-os.home X-ME-Auth: Y2hyaXN0b3BoZS5qYWlsbGV0QHdhbmFkb28uZnI= X-ME-Date: Sun, 18 Sep 2022 08:27:45 +0200 X-ME-IP: 90.11.190.129 From: Christophe JAILLET To: Kumaravel Thiagarajan , Arnd Bergmann , Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Christophe JAILLET , linux-gpio@vger.kernel.org Subject: [PATCH 3/3] misc: microchip: pci1xxxx: Fix the error handling paths of gp_aux_bus_probe() Date: Sun, 18 Sep 2022 08:27:42 +0200 Message-Id: <1b41531de02ee029628d9b0ec2cf1ee7f180fe10.1663482259.git.christophe.jaillet@wanadoo.fr> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" There are several issues related to the error handling paths of gp_aux_bus_probe(): - some resources may be released twice. Once explicitly in the error handling path, and once via the release() function - auxiliary_device_delete() should be called after the first successful auxiliary_device_add() To fix them, reorder the code: - move the place where we get the irq for the 2nd wrapper. - call kfree() and ida_free() after error checks, rather then in the error handling path. - have the error handling path look like the remove function Fixes: 393fc2f5948f ("misc: microchip: pci1xxxx: load auxiliary bus driver = for the PIO function in the multi-function endpoint of pci1xxxx device.") Signed-off-by: Christophe JAILLET Reported-by: kernel test robot --- This patch is speculative and untested, review with care. Other solutions are possible. For example, we could use devm_kzalloc() to simplify the error handling path and the release function. --- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c | 74 ++++++++++--------- 1 file changed, 39 insertions(+), 35 deletions(-) diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c b/drivers/misc/m= chp_pci1xxxx/mchp_pci1xxxx_gp.c index 32af2b14ff34..d3253e98f2ec 100644 --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c @@ -32,7 +32,7 @@ static void gp_auxiliary_device_release(struct device *de= v) static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_= id *id) { struct aux_bus_device *aux_bus; - int retval; + int irq, retval; =20 retval =3D pcim_enable_device(pdev); if (retval) @@ -48,8 +48,10 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const = struct pci_device_id *id return -ENOMEM; =20 retval =3D ida_alloc(&gp_client_ida, GFP_KERNEL); - if (retval < 0) - goto err_ida_alloc_0; + if (retval < 0) { + kfree(aux_bus->aux_device_wrapper[0]); + return retval; + } =20 aux_bus->aux_device_wrapper[0]->aux_dev.name =3D aux_dev_otp_e2p_name; aux_bus->aux_device_wrapper[0]->aux_dev.dev.parent =3D &pdev->dev; @@ -60,21 +62,38 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const= struct pci_device_id *id aux_bus->aux_device_wrapper[0]->gp_aux_data.region_length =3D pci_resourc= e_end(pdev, 0); =20 retval =3D auxiliary_device_init(&aux_bus->aux_device_wrapper[0]->aux_dev= ); - if (retval < 0) - goto err_aux_dev_init_0; + if (retval < 0) { + ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id); + kfree(aux_bus->aux_device_wrapper[0]); + goto err_aux_dev_uninit_0; + } =20 retval =3D auxiliary_device_add(&aux_bus->aux_device_wrapper[0]->aux_dev); if (retval) - goto err_aux_dev_add_0; + goto err_aux_dev_uninit_0; + + + retval =3D pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES); + if (retval < 0) + goto err_aux_dev_del_0; + + retval =3D pci_irq_vector(pdev, 0); + if (retval < 0) + goto err_aux_dev_del_0; + irq =3D retval; =20 aux_bus->aux_device_wrapper[1] =3D kzalloc(sizeof(*aux_bus->aux_device_wr= apper[1]), GFP_KERNEL); - if (!aux_bus->aux_device_wrapper[1]) - return -ENOMEM; + if (!aux_bus->aux_device_wrapper[1]) { + retval =3D -ENOMEM; + goto err_aux_dev_del_0; + } =20 retval =3D ida_alloc(&gp_client_ida, GFP_KERNEL); - if (retval < 0) - goto err_ida_alloc_1; + if (retval < 0) { + kfree(aux_bus->aux_device_wrapper[1]); + goto err_aux_dev_del_0; + } =20 aux_bus->aux_device_wrapper[1]->aux_dev.name =3D aux_dev_gpio_name; aux_bus->aux_device_wrapper[1]->aux_dev.dev.parent =3D &pdev->dev; @@ -84,49 +103,34 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, cons= t struct pci_device_id *id aux_bus->aux_device_wrapper[1]->gp_aux_data.region_start =3D pci_resource= _start(pdev, 0); aux_bus->aux_device_wrapper[1]->gp_aux_data.region_length =3D pci_resourc= e_end(pdev, 0); =20 - retval =3D pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES); - - if (retval < 0) - goto err_aux_dev_init_1; - - retval =3D pci_irq_vector(pdev, 0); - if (retval < 0) - goto err_aux_dev_init_1; - pdev->irq =3D retval; aux_bus->aux_device_wrapper[1]->gp_aux_data.irq_num =3D pdev->irq; =20 retval =3D auxiliary_device_init(&aux_bus->aux_device_wrapper[1]->aux_dev= ); - if (retval < 0) - goto err_aux_dev_init_1; + if (retval < 0) { + ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id); + kfree(aux_bus->aux_device_wrapper[1]); + goto err_aux_dev_del_0; + } =20 retval =3D auxiliary_device_add(&aux_bus->aux_device_wrapper[1]->aux_dev); if (retval) - goto err_aux_dev_add_1; + goto err_aux_dev_uninit_1; =20 pci_set_drvdata(pdev, aux_bus); pci_set_master(pdev); =20 return 0; =20 -err_aux_dev_add_1: +err_aux_dev_uninit_1: auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev); =20 -err_aux_dev_init_1: - ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id); - -err_ida_alloc_1: - kfree(aux_bus->aux_device_wrapper[1]); +err_aux_dev_del_0: + auxiliary_device_delete(&aux_bus->aux_device_wrapper[0]->aux_dev); =20 -err_aux_dev_add_0: +err_aux_dev_uninit_0: auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev); =20 -err_aux_dev_init_0: - ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id); - -err_ida_alloc_0: - kfree(aux_bus->aux_device_wrapper[0]); - return retval; } =20 --=20 2.34.1