[PATCH] staging: vme_user: fix flush_image leak in tsi148 bridge

[PATCH] staging: vme_user: fix flush_image leak in tsi148 bridge

[Cong Nguyen]

When error checking is enabled (err_chk=1), tsi148_probe() allocates an
extra master window resource, tsi148_device->flush_image, which is used
to flush posted writes by reading back over the VME bus. Unlike the
regular master windows, this resource is not linked into
tsi148_bridge->master_resources.

Because it is not on any resource list, it is freed neither by the probe
error path (which only walks the master_resources list) nor by
tsi148_remove(), so it is leaked whenever err_chk is set and either
probe fails after the allocation or the device is unbound / the module
is unloaded.

Free flush_image in both the probe error path and tsi148_remove(). This
is safe when err_chk is disabled: tsi148_device is allocated with
kzalloc() so flush_image is NULL and kfree(NULL) is a no-op.

Fixes: d22b8ed9a3b0 ("Staging: vme: add Tundra TSI148 VME-PCI Bridge driver")
Cc: stable@vger.kernel.org
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
---
 drivers/staging/vme_user/vme_tsi148.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/vme_user/vme_tsi148.c b/drivers/staging/vme_user/vme_tsi148.c
index c695ad9b4ca2..8ee1e00cef4f 100644
--- a/drivers/staging/vme_user/vme_tsi148.c
+++ b/drivers/staging/vme_user/vme_tsi148.c
@@ -2513,6 +2513,7 @@ static int tsi148_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		list_del(pos);
 		kfree(master_image);
 	}
+	kfree(tsi148_device->flush_image);
 
 	tsi148_irq_exit(tsi148_bridge, pdev);
 err_irq:
@@ -2619,6 +2620,8 @@ static void tsi148_remove(struct pci_dev *pdev)
 		kfree(master_image);
 	}
 
+	kfree(bridge->flush_image);
+
 	iounmap(bridge->base);
 
 	pci_release_regions(pdev);
-- 
2.25.1

Re: [PATCH] staging: vme_user: fix flush_image leak in tsi148 bridge

[Greg Kroah-Hartman]

On Mon, Jul 27, 2026 at 06:15:34PM +0700, Cong Nguyen wrote:
> When error checking is enabled (err_chk=1), tsi148_probe() allocates an
> extra master window resource, tsi148_device->flush_image, which is used
> to flush posted writes by reading back over the VME bus. Unlike the
> regular master windows, this resource is not linked into
> tsi148_bridge->master_resources.
> 
> Because it is not on any resource list, it is freed neither by the probe
> error path (which only walks the master_resources list) nor by
> tsi148_remove(), so it is leaked whenever err_chk is set and either
> probe fails after the allocation or the device is unbound / the module
> is unloaded.
> 
> Free flush_image in both the probe error path and tsi148_remove(). This
> is safe when err_chk is disabled: tsi148_device is allocated with
> kzalloc() so flush_image is NULL and kfree(NULL) is a no-op.
> 
> Fixes: d22b8ed9a3b0 ("Staging: vme: add Tundra TSI148 VME-PCI Bridge driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Cong Nguyen <congnt264@gmail.com>
> ---
>  drivers/staging/vme_user/vme_tsi148.c | 3 +++
>  1 file changed, 3 insertions(+)

How was this found and tested?

Did you forget an Assisted-by: tag?

thanks,

greg k-h

Re: [PATCH] staging: vme_user: fix flush_image leak in tsi148 bridge

[Nguyễn Công]

On Wed, Aug 12, 2026 at 7:25 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Mon, Jul 27, 2026 at 06:15:34PM +0700, Cong Nguyen wrote:
> > When error checking is enabled (err_chk=1), tsi148_probe() allocates an
> > extra master window resource, tsi148_device->flush_image, which is used
> > to flush posted writes by reading back over the VME bus. Unlike the
> > regular master windows, this resource is not linked into
> > tsi148_bridge->master_resources.
> >
> > Because it is not on any resource list, it is freed neither by the probe
> > error path (which only walks the master_resources list) nor by
> > tsi148_remove(), so it is leaked whenever err_chk is set and either
> > probe fails after the allocation or the device is unbound / the module
> > is unloaded.
> >
> > Free flush_image in both the probe error path and tsi148_remove(). This
> > is safe when err_chk is disabled: tsi148_device is allocated with
> > kzalloc() so flush_image is NULL and kfree(NULL) is a no-op.
> >
> > Fixes: d22b8ed9a3b0 ("Staging: vme: add Tundra TSI148 VME-PCI Bridge driver")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Cong Nguyen <congnt264@gmail.com>
> > ---
> >  drivers/staging/vme_user/vme_tsi148.c | 3 +++
> >  1 file changed, 3 insertions(+)
>
> How was this found and tested?

Code inspection: flush_image is allocated in tsi148_probe() (when
err_chk is set) but never added to master_resources, while both the
probe error path and tsi148_remove() only free windows on that list.
Build-tested only; I have no TSI148 hardware.

>
> Did you forget an Assisted-by: tag?

Yes, sorry -- found with AI assistance and I missed the tag. I'll send a
v2 adding:
Assisted-by: Claude:claude-opus-4

>
> thanks,
>
> greg k-h

Thanks,
Cong