[PATCH] clocksource/drivers/bcm2835_timer: fix memory leak of timer

[PATCH] clocksource/drivers/bcm2835_timer: fix memory leak of timer

[Colin King]

From: Colin Ian King <colin.king@canonical.com>

Currently when setup_irq fails the error exit path will leak the
recently allocated timer structure.  Originally the code would
throw a panic but a later commit changed the behaviour to return
via the err_iounmap path and hence we now have a memory leak. Fix
this by adding a err_timer_free error path that kfree's timer.

Addresses-Coverity: ("Resource Leak")
Fixes: 524a7f08983d ("clocksource/drivers/bcm2835_timer: Convert init function to return error")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/clocksource/bcm2835_timer.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/clocksource/bcm2835_timer.c b/drivers/clocksource/bcm2835_timer.c
index 2b196cbfadb6..b235f446ee50 100644
--- a/drivers/clocksource/bcm2835_timer.c
+++ b/drivers/clocksource/bcm2835_timer.c
@@ -121,7 +121,7 @@ static int __init bcm2835_timer_init(struct device_node *node)
 	ret = setup_irq(irq, &timer->act);
 	if (ret) {
 		pr_err("Can't set up timer IRQ\n");
-		goto err_iounmap;
+		goto err_timer_free;
 	}
 
 	clockevents_config_and_register(&timer->evt, freq, 0xf, 0xffffffff);
@@ -130,6 +130,9 @@ static int __init bcm2835_timer_init(struct device_node *node)
 
 	return 0;
 
+err_timer_free:
+	kfree(timer);
+
 err_iounmap:
 	iounmap(base);
 	return ret;
-- 
2.24.0

Re: [PATCH] clocksource/drivers/bcm2835_timer: fix memory leak of timer

[Daniel Lezcano]

Applied, thanks!

On 19/12/2019 22:32, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
> 
> Currently when setup_irq fails the error exit path will leak the
> recently allocated timer structure.  Originally the code would
> throw a panic but a later commit changed the behaviour to return
> via the err_iounmap path and hence we now have a memory leak. Fix
> this by adding a err_timer_free error path that kfree's timer.
> 
> Addresses-Coverity: ("Resource Leak")
> Fixes: 524a7f08983d ("clocksource/drivers/bcm2835_timer: Convert init function to return error")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
>  drivers/clocksource/bcm2835_timer.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/clocksource/bcm2835_timer.c b/drivers/clocksource/bcm2835_timer.c
> index 2b196cbfadb6..b235f446ee50 100644
> --- a/drivers/clocksource/bcm2835_timer.c
> +++ b/drivers/clocksource/bcm2835_timer.c
> @@ -121,7 +121,7 @@ static int __init bcm2835_timer_init(struct device_node *node)
>  	ret = setup_irq(irq, &timer->act);
>  	if (ret) {
>  		pr_err("Can't set up timer IRQ\n");
> -		goto err_iounmap;
> +		goto err_timer_free;
>  	}
>  
>  	clockevents_config_and_register(&timer->evt, freq, 0xf, 0xffffffff);
> @@ -130,6 +130,9 @@ static int __init bcm2835_timer_init(struct device_node *node)
>  
>  	return 0;
>  
> +err_timer_free:
> +	kfree(timer);
> +
>  err_iounmap:
>  	iounmap(base);
>  	return ret;
> 


-- 
 <http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro:  <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog

[tip: timers/core] clocksource/drivers/bcm2835_timer: Fix memory leak of timer

[tip-bot2 for Colin Ian King]

The following commit has been merged into the timers/core branch of tip:

Commit-ID:     2052d032c06761330bca4944bb7858b00960e868
Gitweb:        https://git.kernel.org/tip/2052d032c06761330bca4944bb7858b00960e868
Author:        Colin Ian King <colin.king@canonical.com>
AuthorDate:    Thu, 19 Dec 2019 21:32:46 
Committer:     Daniel Lezcano <daniel.lezcano@linaro.org>
CommitterDate: Thu, 16 Jan 2020 19:06:57 +01:00

clocksource/drivers/bcm2835_timer: Fix memory leak of timer

Currently when setup_irq fails the error exit path will leak the
recently allocated timer structure.  Originally the code would
throw a panic but a later commit changed the behaviour to return
via the err_iounmap path and hence we now have a memory leak. Fix
this by adding a err_timer_free error path that kfree's timer.

Addresses-Coverity: ("Resource Leak")
Fixes: 524a7f08983d ("clocksource/drivers/bcm2835_timer: Convert init function to return error")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20191219213246.34437-1-colin.king@canonical.com
---
 drivers/clocksource/bcm2835_timer.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/clocksource/bcm2835_timer.c b/drivers/clocksource/bcm2835_timer.c
index 2b196cb..b235f44 100644
--- a/drivers/clocksource/bcm2835_timer.c
+++ b/drivers/clocksource/bcm2835_timer.c
@@ -121,7 +121,7 @@ static int __init bcm2835_timer_init(struct device_node *node)
 	ret = setup_irq(irq, &timer->act);
 	if (ret) {
 		pr_err("Can't set up timer IRQ\n");
-		goto err_iounmap;
+		goto err_timer_free;
 	}
 
 	clockevents_config_and_register(&timer->evt, freq, 0xf, 0xffffffff);
@@ -130,6 +130,9 @@ static int __init bcm2835_timer_init(struct device_node *node)
 
 	return 0;
 
+err_timer_free:
+	kfree(timer);
+
 err_iounmap:
 	iounmap(base);
 	return ret;