* [PATCH] gpib: tnt4882: fix memory leak on probe failure
@ 2026-09-13 6:36 Guangshuo Li
2026-09-13 21:22 ` kernel test robot
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Guangshuo Li @ 2026-09-13 6:36 UTC (permalink / raw)
To: Dave Penkler, Greg Kroah-Hartman, Dominik Karol Piątkowski,
Uwe Kleine-König (The Capable Hub),
Guangshuo Li, Kees Cook, linux-kernel
Cc: stable
ni_gpib_probe() allocates a local_info_t structure and stores it in
link->priv before calling ni_gpib_config().
If ni_gpib_config() fails, it calls ni_gpib_release(), which only
disables the PCMCIA device and does not free the local_info_t
structure. Since probe then returns an error, the remove callback is
not called and the allocation is leaked.
Handle the configuration failure in ni_gpib_probe() by freeing the
local_info_t structure and clearing link->priv before returning the
error.
This issue was found by manual code inspection.
Fixes: 0cd5b05551e02 ("staging: gpib: Add TNT4882 chip based GPIB driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
drivers/gpib/tnt4882/tnt4882_gpib.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/gpib/tnt4882/tnt4882_gpib.c b/drivers/gpib/tnt4882/tnt4882_gpib.c
index 3cd13f637ed4..fc201ad17e30 100644
--- a/drivers/gpib/tnt4882/tnt4882_gpib.c
+++ b/drivers/gpib/tnt4882/tnt4882_gpib.c
@@ -1585,7 +1585,13 @@ static int ni_gpib_probe(struct pcmcia_device *link)
/* Register with Card Services */
curr_dev = link;
- return ni_gpib_config(link);
+ ret = ni_gpib_config(link);
+ if (ret) {
+ kfree(info);
+ link->priv = NULL;
+ }
+
+ return ret;
}
/*
--
2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] gpib: tnt4882: fix memory leak on probe failure
2026-09-13 6:36 [PATCH] gpib: tnt4882: fix memory leak on probe failure Guangshuo Li
@ 2026-09-13 21:22 ` kernel test robot
2026-09-13 22:16 ` kernel test robot
2026-09-14 6:06 ` kernel test robot
2 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2026-09-13 21:22 UTC (permalink / raw)
To: Guangshuo Li, Dave Penkler, Greg Kroah-Hartman,
Dominik Karol Piątkowski,
Uwe Kleine-König (The Capable Hub),
Kees Cook, linux-kernel
Cc: oe-kbuild-all, stable
Hi Guangshuo,
kernel test robot noticed the following build errors:
[auto build test ERROR on kees/for-next/kspp]
[also build test ERROR on linus/master kees/for-next/pstore v7.3-rc2 next-20260911]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Guangshuo-Li/gpib-tnt4882-fix-memory-leak-on-probe-failure/20260913-143603
base: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/kspp
patch link: https://lore.kernel.org/r/20260913063603.1443403-1-lgs201920130244%40gmail.com
patch subject: [PATCH] gpib: tnt4882: fix memory leak on probe failure
config: mips-randconfig-r132-20260914 (https://download.01.org/0day-ci/archive/20260914/202609140501.8A2YYS6n-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 148ee2b266b73a49f1f31d0bd17d4818b91bee9f)
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260914/202609140501.8A2YYS6n-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609140501.8A2YYS6n-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/gpib/tnt4882/tnt4882_gpib.c:1588:2: error: use of undeclared identifier 'ret'
1588 | ret = ni_gpib_config(link);
| ^~~
drivers/gpib/tnt4882/tnt4882_gpib.c:1589:6: error: use of undeclared identifier 'ret'
1589 | if (ret) {
| ^~~
drivers/gpib/tnt4882/tnt4882_gpib.c:1594:9: error: use of undeclared identifier 'ret'
1594 | return ret;
| ^~~
3 errors generated.
vim +/ret +1588 drivers/gpib/tnt4882/tnt4882_gpib.c
1557
1558 /*
1559 * ni_gpib_probe() creates an "instance" of the driver, allocating
1560 * local data structures for one device. The device is registered
1561 * with Card Services.
1562 */
1563
1564 static int ni_gpib_probe(struct pcmcia_device *link)
1565 {
1566 struct local_info_t *info;
1567 //struct struct gpib_board *dev;
1568
1569 /* Allocate space for private device-specific data */
1570 info = kzalloc_obj(*info);
1571 if (!info)
1572 return -ENOMEM;
1573
1574 info->p_dev = link;
1575 link->priv = info;
1576
1577 /*
1578 * General socket configuration defaults can go here. In this
1579 * client, we assume very little, and rely on the CIS for almost
1580 * everything. In most clients, many details (i.e., number, sizes,
1581 * and attributes of IO windows) are fixed by the nature of the
1582 * device, and can be hard-wired here.
1583 */
1584 link->config_flags = CONF_ENABLE_IRQ | CONF_AUTO_SET_IO;
1585
1586 /* Register with Card Services */
1587 curr_dev = link;
> 1588 ret = ni_gpib_config(link);
1589 if (ret) {
1590 kfree(info);
1591 link->priv = NULL;
1592 }
1593
1594 return ret;
1595 }
1596
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] gpib: tnt4882: fix memory leak on probe failure
2026-09-13 6:36 [PATCH] gpib: tnt4882: fix memory leak on probe failure Guangshuo Li
2026-09-13 21:22 ` kernel test robot
@ 2026-09-13 22:16 ` kernel test robot
2026-09-14 6:06 ` kernel test robot
2 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2026-09-13 22:16 UTC (permalink / raw)
To: Guangshuo Li, Dave Penkler, Greg Kroah-Hartman,
Dominik Karol Piątkowski,
Uwe Kleine-König (The Capable Hub),
Kees Cook, linux-kernel
Cc: oe-kbuild-all, stable
Hi Guangshuo,
kernel test robot noticed the following build warnings:
[auto build test WARNING on kees/for-next/kspp]
[also build test WARNING on linus/master kees/for-next/pstore v7.3-rc2 next-20260911]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Guangshuo-Li/gpib-tnt4882-fix-memory-leak-on-probe-failure/20260913-143603
base: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/kspp
patch link: https://lore.kernel.org/r/20260913063603.1443403-1-lgs201920130244%40gmail.com
patch subject: [PATCH] gpib: tnt4882: fix memory leak on probe failure
config: x86_64-randconfig-r133-20260914 (https://download.01.org/0day-ci/archive/20260914/202609140612.F8ICypXs-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260914/202609140612.F8ICypXs-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609140612.F8ICypXs-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/gpib/tnt4882/tnt4882_gpib.c: In function 'ni_gpib_probe':
drivers/gpib/tnt4882/tnt4882_gpib.c:1588:9: error: 'ret' undeclared (first use in this function); did you mean 'net'?
1588 | ret = ni_gpib_config(link);
| ^~~
| net
drivers/gpib/tnt4882/tnt4882_gpib.c:1588:9: note: each undeclared identifier is reported only once for each function it appears in
>> drivers/gpib/tnt4882/tnt4882_gpib.c:1595:1: warning: control reaches end of non-void function [-Wreturn-type]
1595 | }
| ^
vim +1595 drivers/gpib/tnt4882/tnt4882_gpib.c
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1557
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1558 /*
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1559 * ni_gpib_probe() creates an "instance" of the driver, allocating
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1560 * local data structures for one device. The device is registered
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1561 * with Card Services.
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1562 */
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1563
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1564 static int ni_gpib_probe(struct pcmcia_device *link)
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1565 {
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1566 struct local_info_t *info;
fc2c620c3924f26 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Michael Rubin 2025-03-19 1567 //struct struct gpib_board *dev;
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1568
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1569 /* Allocate space for private device-specific data */
bf4afc53b77aeaa drivers/gpib/tnt4882/tnt4882_gpib.c Linus Torvalds 2026-02-21 1570 info = kzalloc_obj(*info);
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1571 if (!info)
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1572 return -ENOMEM;
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1573
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1574 info->p_dev = link;
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1575 link->priv = info;
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1576
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1577 /*
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1578 * General socket configuration defaults can go here. In this
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1579 * client, we assume very little, and rely on the CIS for almost
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1580 * everything. In most clients, many details (i.e., number, sizes,
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1581 * and attributes of IO windows) are fixed by the nature of the
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1582 * device, and can be hard-wired here.
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1583 */
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1584 link->config_flags = CONF_ENABLE_IRQ | CONF_AUTO_SET_IO;
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1585
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1586 /* Register with Card Services */
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1587 curr_dev = link;
4d0c779a70d29c2 drivers/gpib/tnt4882/tnt4882_gpib.c Guangshuo Li 2026-09-13 1588 ret = ni_gpib_config(link);
4d0c779a70d29c2 drivers/gpib/tnt4882/tnt4882_gpib.c Guangshuo Li 2026-09-13 1589 if (ret) {
4d0c779a70d29c2 drivers/gpib/tnt4882/tnt4882_gpib.c Guangshuo Li 2026-09-13 1590 kfree(info);
4d0c779a70d29c2 drivers/gpib/tnt4882/tnt4882_gpib.c Guangshuo Li 2026-09-13 1591 link->priv = NULL;
4d0c779a70d29c2 drivers/gpib/tnt4882/tnt4882_gpib.c Guangshuo Li 2026-09-13 1592 }
4d0c779a70d29c2 drivers/gpib/tnt4882/tnt4882_gpib.c Guangshuo Li 2026-09-13 1593
4d0c779a70d29c2 drivers/gpib/tnt4882/tnt4882_gpib.c Guangshuo Li 2026-09-13 1594 return ret;
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 @1595 }
0cd5b05551e0224 drivers/staging/gpib/tnt4882/tnt4882_gpib.c Dave Penkler 2024-09-18 1596
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] gpib: tnt4882: fix memory leak on probe failure
2026-09-13 6:36 [PATCH] gpib: tnt4882: fix memory leak on probe failure Guangshuo Li
2026-09-13 21:22 ` kernel test robot
2026-09-13 22:16 ` kernel test robot
@ 2026-09-14 6:06 ` kernel test robot
2 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2026-09-14 6:06 UTC (permalink / raw)
To: Guangshuo Li, Dave Penkler, Greg Kroah-Hartman,
Dominik Karol Piątkowski,
Uwe Kleine-König (The Capable Hub),
Kees Cook, linux-kernel
Cc: oe-kbuild-all, stable
Hi Guangshuo,
kernel test robot noticed the following build errors:
[auto build test ERROR on kees/for-next/kspp]
[also build test ERROR on linus/master kees/for-next/pstore v7.3-rc3 next-20260911]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Guangshuo-Li/gpib-tnt4882-fix-memory-leak-on-probe-failure/20260913-143603
base: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/kspp
patch link: https://lore.kernel.org/r/20260913063603.1443403-1-lgs201920130244%40gmail.com
patch subject: [PATCH] gpib: tnt4882: fix memory leak on probe failure
config: x86_64-randconfig-r133-20260914 (https://download.01.org/0day-ci/archive/20260914/202609141321.qGDHzSqJ-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260914/202609141321.qGDHzSqJ-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609141321.qGDHzSqJ-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/gpib/tnt4882/tnt4882_gpib.c: In function 'ni_gpib_probe':
>> drivers/gpib/tnt4882/tnt4882_gpib.c:1588:9: error: 'ret' undeclared (first use in this function); did you mean 'net'?
1588 | ret = ni_gpib_config(link);
| ^~~
| net
drivers/gpib/tnt4882/tnt4882_gpib.c:1588:9: note: each undeclared identifier is reported only once for each function it appears in
drivers/gpib/tnt4882/tnt4882_gpib.c:1595:1: warning: control reaches end of non-void function [-Wreturn-type]
1595 | }
| ^
vim +1588 drivers/gpib/tnt4882/tnt4882_gpib.c
1557
1558 /*
1559 * ni_gpib_probe() creates an "instance" of the driver, allocating
1560 * local data structures for one device. The device is registered
1561 * with Card Services.
1562 */
1563
1564 static int ni_gpib_probe(struct pcmcia_device *link)
1565 {
1566 struct local_info_t *info;
1567 //struct struct gpib_board *dev;
1568
1569 /* Allocate space for private device-specific data */
1570 info = kzalloc_obj(*info);
1571 if (!info)
1572 return -ENOMEM;
1573
1574 info->p_dev = link;
1575 link->priv = info;
1576
1577 /*
1578 * General socket configuration defaults can go here. In this
1579 * client, we assume very little, and rely on the CIS for almost
1580 * everything. In most clients, many details (i.e., number, sizes,
1581 * and attributes of IO windows) are fixed by the nature of the
1582 * device, and can be hard-wired here.
1583 */
1584 link->config_flags = CONF_ENABLE_IRQ | CONF_AUTO_SET_IO;
1585
1586 /* Register with Card Services */
1587 curr_dev = link;
> 1588 ret = ni_gpib_config(link);
1589 if (ret) {
1590 kfree(info);
1591 link->priv = NULL;
1592 }
1593
1594 return ret;
1595 }
1596
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-14 6:07 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-13 6:36 [PATCH] gpib: tnt4882: fix memory leak on probe failure Guangshuo Li
2026-09-13 21:22 ` kernel test robot
2026-09-13 22:16 ` kernel test robot
2026-09-14 6:06 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®