From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1DAEC83F3E for ; Tue, 5 Sep 2023 16:33:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354953AbjIEQaU (ORCPT ); Tue, 5 Sep 2023 12:30:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42312 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354121AbjIEJnD (ORCPT ); Tue, 5 Sep 2023 05:43:03 -0400 Received: from smtp-fw-2101.amazon.com (smtp-fw-2101.amazon.com [72.21.196.25]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F35921AD; Tue, 5 Sep 2023 02:42:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.de; i=@amazon.de; q=dns/txt; s=amazon201209; t=1693906979; x=1725442979; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=O0H3j8c8BQZviF3vxfdKkYvpPvrhf6bVYI7dwJKyPqU=; b=Vf2qLBaTB7bbIURLT+DZKiT7+v8p5sG+bkDz4wZTTZkPgeqgs1/cY3Jm lPhnjEcEnIeD4i+xKDh8RTaNBPekjurPP8++2/NfdNFfn6hqGFqsc2jmQ QERpwIkrk9xXni8zAfq1vDb5xj4k7PuXdIulhCVL1JpcVmDFQ36h+B8cC E=; X-IronPort-AV: E=Sophos;i="6.02,229,1688428800"; d="scan'208";a="349440223" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-pdx-2b-m6i4x-7fa2de02.us-west-2.amazon.com) ([10.43.8.6]) by smtp-border-fw-2101.iad2.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2023 09:42:55 +0000 Received: from EX19D008EUA001.ant.amazon.com (pdx1-ws-svc-p6-lb9-vlan3.pdx.amazon.com [10.236.137.198]) by email-inbound-relay-pdx-2b-m6i4x-7fa2de02.us-west-2.amazon.com (Postfix) with ESMTPS id 35C6A40D88; Tue, 5 Sep 2023 09:42:54 +0000 (UTC) Received: from EX19MTAUWC001.ant.amazon.com (10.250.64.145) by EX19D008EUA001.ant.amazon.com (10.252.50.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.37; Tue, 5 Sep 2023 09:42:49 +0000 Received: from dev-dsk-mheyne-1b-c1362c4d.eu-west-1.amazon.com (10.15.57.183) by mail-relay.amazon.com (10.250.64.145) with Microsoft SMTP Server id 15.2.1118.37 via Frontend Transport; Tue, 5 Sep 2023 09:42:47 +0000 Received: by dev-dsk-mheyne-1b-c1362c4d.eu-west-1.amazon.com (Postfix, from userid 5466572) id 750807BBB; Tue, 5 Sep 2023 09:42:47 +0000 (UTC) From: Maximilian Heyne CC: Maximilian Heyne , , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , Wolfram Sang , , Subject: [PATCH] virtio-mmio: fix memory leak of vm_dev Date: Tue, 5 Sep 2023 09:42:28 +0000 Message-ID: <20230905094228.97125-1-mheyne@amazon.de> X-Mailer: git-send-email 2.40.1 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org With the recent removal of vm_dev from devres its memory is only freed via the callback virtio_mmio_release_dev. However, this only takes effect after device_add is called by register_virtio_device. Until then it's an unmanaged resource and must be explicitly freed on error exit. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Cc: stable@vger.kernel.org Fixes: 55c91fedd03d ("virtio-mmio: don't break lifecycle of vm_dev") Signed-off-by: Maximilian Heyne --- Please note that I have only compile tested this code. drivers/virtio/virtio_mmio.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c index 97760f611295..b2a48d07e973 100644 --- a/drivers/virtio/virtio_mmio.c +++ b/drivers/virtio/virtio_mmio.c @@ -631,13 +631,16 @@ static int virtio_mmio_probe(struct platform_device *pdev) spin_lock_init(&vm_dev->lock); vm_dev->base = devm_platform_ioremap_resource(pdev, 0); - if (IS_ERR(vm_dev->base)) + if (IS_ERR(vm_dev->base)) { + kfree(vm_dev); return PTR_ERR(vm_dev->base); + } /* Check magic value */ magic = readl(vm_dev->base + VIRTIO_MMIO_MAGIC_VALUE); if (magic != ('v' | 'i' << 8 | 'r' << 16 | 't' << 24)) { dev_warn(&pdev->dev, "Wrong magic value 0x%08lx!\n", magic); + kfree(vm_dev); return -ENODEV; } @@ -646,6 +649,7 @@ static int virtio_mmio_probe(struct platform_device *pdev) if (vm_dev->version < 1 || vm_dev->version > 2) { dev_err(&pdev->dev, "Version %ld not supported!\n", vm_dev->version); + kfree(vm_dev); return -ENXIO; } @@ -655,6 +659,7 @@ static int virtio_mmio_probe(struct platform_device *pdev) * virtio-mmio device with an ID 0 is a (dummy) placeholder * with no function. End probing now with no error reported. */ + kfree(vm_dev); return -ENODEV; } vm_dev->vdev.id.vendor = readl(vm_dev->base + VIRTIO_MMIO_VENDOR_ID); -- 2.40.1 Amazon Development Center Germany GmbH Krausenstr. 38 10117 Berlin Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B Sitz: Berlin Ust-ID: DE 289 237 879