| Message ID | 20201004100218.311653-1-alex.dewar90@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [1/2] ath11k: Fix memory leak on error path | expand |
Alex Dewar <alex.dewar90@gmail.com> writes: > ath11k_peer_create() is called without its return value being checked, > meaning errors will be unhandled. Add missing check and, as the mutex is > unconditionally unlocked on leaving this function, simplify the exit > path. > > Addresses-Coverity-ID: 1497531 ("Code maintainability issues") > Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com> > --- > drivers/net/wireless/ath/ath11k/mac.c | 21 +++++++++------------ > 1 file changed, 9 insertions(+), 12 deletions(-) > > diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c > index 7f8dd47d2333..58db1b57b941 100644 > --- a/drivers/net/wireless/ath/ath11k/mac.c > +++ b/drivers/net/wireless/ath/ath11k/mac.c > @@ -5211,7 +5211,7 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, > struct ath11k *ar = hw->priv; > struct ath11k_base *ab = ar->ab; > struct ath11k_vif *arvif = (void *)vif->drv_priv; > - int ret; > + int ret = 0; I prefer not to initialise the ret variable. > arvif->is_started = true; > > /* TODO: Setup ps and cts/rts protection */ > > - mutex_unlock(&ar->conf_mutex); > - > - return 0; > - > -err: > +unlock: > mutex_unlock(&ar->conf_mutex); > > return ret; So in the pending branch I changed this to: ret = 0; out: mutex_unlock(&ar->conf_mutex); return ret; Please check. -- https://patchwork.kernel.org/project/linux-wireless/list/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
On Tue, Oct 06, 2020 at 10:26:28AM +0300, Kalle Valo wrote: > Alex Dewar <alex.dewar90@gmail.com> writes: > > > ath11k_peer_create() is called without its return value being checked, > > meaning errors will be unhandled. Add missing check and, as the mutex is > > unconditionally unlocked on leaving this function, simplify the exit > > path. > > > > Addresses-Coverity-ID: 1497531 ("Code maintainability issues") > > Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") > > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com> > > --- > > drivers/net/wireless/ath/ath11k/mac.c | 21 +++++++++------------ > > 1 file changed, 9 insertions(+), 12 deletions(-) > > > > diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c > > index 7f8dd47d2333..58db1b57b941 100644 > > --- a/drivers/net/wireless/ath/ath11k/mac.c > > +++ b/drivers/net/wireless/ath/ath11k/mac.c > > @@ -5211,7 +5211,7 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, > > struct ath11k *ar = hw->priv; > > struct ath11k_base *ab = ar->ab; > > struct ath11k_vif *arvif = (void *)vif->drv_priv; > > - int ret; > > + int ret = 0; > > I prefer not to initialise the ret variable. > > > arvif->is_started = true; > > > > /* TODO: Setup ps and cts/rts protection */ > > > > - mutex_unlock(&ar->conf_mutex); > > - > > - return 0; > > - > > -err: > > +unlock: > > mutex_unlock(&ar->conf_mutex); > > > > return ret; > > So in the pending branch I changed this to: > > ret = 0; > > out: > mutex_unlock(&ar->conf_mutex); > > return ret; > > Please check. Hi Kalle, I'm afraid you've introduced a bug ;). The body of the first if-statement in the function doesn't set ret because no error has occurred. So now it'll jump to the label and the function will return ret uninitialized. With the gcc extension, ret will be initialised to zero anyway, so we're not saving anything by explicitly assigning to ret later in the function. Best, Alex > > -- > https://patchwork.kernel.org/project/linux-wireless/list/ > > https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
On Sat, Nov 07, 2020 at 01:23:30PM +0200, Kalle Valo wrote: > Alex Dewar <alex.dewar90@gmail.com> writes: > > > On Tue, Oct 06, 2020 at 10:26:28AM +0300, Kalle Valo wrote: > >> Alex Dewar <alex.dewar90@gmail.com> writes: > >> > >> > ath11k_peer_create() is called without its return value being checked, > >> > meaning errors will be unhandled. Add missing check and, as the mutex is > >> > unconditionally unlocked on leaving this function, simplify the exit > >> > path. > >> > > >> > Addresses-Coverity-ID: 1497531 ("Code maintainability issues") > >> > Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") > >> > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com> > >> > --- > >> > drivers/net/wireless/ath/ath11k/mac.c | 21 +++++++++------------ > >> > 1 file changed, 9 insertions(+), 12 deletions(-) > >> > > >> > diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c > >> > index 7f8dd47d2333..58db1b57b941 100644 > >> > --- a/drivers/net/wireless/ath/ath11k/mac.c > >> > +++ b/drivers/net/wireless/ath/ath11k/mac.c > >> > @@ -5211,7 +5211,7 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, > >> > struct ath11k *ar = hw->priv; > >> > struct ath11k_base *ab = ar->ab; > >> > struct ath11k_vif *arvif = (void *)vif->drv_priv; > >> > - int ret; > >> > + int ret = 0; > >> > >> I prefer not to initialise the ret variable. > >> > >> > arvif->is_started = true; > >> > > >> > /* TODO: Setup ps and cts/rts protection */ > >> > > >> > - mutex_unlock(&ar->conf_mutex); > >> > - > >> > - return 0; > >> > - > >> > -err: > >> > +unlock: > >> > mutex_unlock(&ar->conf_mutex); > >> > > >> > return ret; > >> > >> So in the pending branch I changed this to: > >> > >> ret = 0; > >> > >> out: > >> mutex_unlock(&ar->conf_mutex); > >> > >> return ret; > >> > >> Please check. > > > > I'm afraid you've introduced a bug ;). The body of the first if-statement > > in the function doesn't set ret because no error has occurred. So now > > it'll jump to the label and the function will return ret uninitialized. > > Ouch, so I did. Good catch! I would have hoped that GCC warns about that > but it didn't. > > I fixed the bug and added also a warning messages if peer_create() > fails: > > https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?h=pending&id=e3e7b8072fa6bb0928b9066cf76e19e6bd2ec663 > > Does this look better now? :) LGTM! > > > With the gcc extension, ret will be initialised to zero anyway, so we're > > not saving anything by explicitly assigning to ret later in the > > function. > > I prefer not to initialise ret in the beginning of the function and I > try to maintain that style in ath11k. I think it's more readable that > the error value is assigned just before the goto. Fair enough. I appreciate that it's a style issue. > > -- > https://patchwork.kernel.org/project/linux-wireless/list/ > > https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
Alex Dewar <alex.dewar90@gmail.com> wrote: > ath11k_peer_create() is called without its return value being checked, > meaning errors will be unhandled. Add missing check and, as the mutex is > unconditionally unlocked on leaving this function, simplify the exit > path. > > Addresses-Coverity-ID: 1497531 ("Code maintainability issues") > Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Patch applied to ath-next branch of ath.git, thanks. c134d1f8c436 ath11k: Handle errors if peer creation fails -- https://patchwork.kernel.org/project/linux-wireless/patch/20201004100218.311653-1-alex.dewar90@gmail.com/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c index 7f8dd47d2333..58db1b57b941 100644 --- a/drivers/net/wireless/ath/ath11k/mac.c +++ b/drivers/net/wireless/ath/ath11k/mac.c @@ -5211,7 +5211,7 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, struct ath11k *ar = hw->priv; struct ath11k_base *ab = ar->ab; struct ath11k_vif *arvif = (void *)vif->drv_priv; - int ret; + int ret = 0; struct peer_create_params param; mutex_lock(&ar->conf_mutex); @@ -5225,13 +5225,12 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, arvif->vdev_type != WMI_VDEV_TYPE_AP && arvif->vdev_type != WMI_VDEV_TYPE_MONITOR) { memcpy(&arvif->chanctx, ctx, sizeof(*ctx)); - mutex_unlock(&ar->conf_mutex); - return 0; + goto unlock; } if (WARN_ON(arvif->is_started)) { - mutex_unlock(&ar->conf_mutex); - return -EBUSY; + ret = -EBUSY; + goto unlock; } if (ab->hw_params.vdev_start_delay) { @@ -5239,6 +5238,8 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, param.peer_type = WMI_PEER_TYPE_DEFAULT; param.peer_addr = ar->mac_addr; ret = ath11k_peer_create(ar, arvif, NULL, ¶m); + if (ret) + goto unlock; } ret = ath11k_mac_vdev_start(arvif, &ctx->def); @@ -5246,23 +5247,19 @@ ath11k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, ath11k_warn(ab, "failed to start vdev %i addr %pM on freq %d: %d\n", arvif->vdev_id, vif->addr, ctx->def.chan->center_freq, ret); - goto err; + goto unlock; } if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) { ret = ath11k_monitor_vdev_up(ar, arvif->vdev_id); if (ret) - goto err; + goto unlock; } arvif->is_started = true; /* TODO: Setup ps and cts/rts protection */ - mutex_unlock(&ar->conf_mutex); - - return 0; - -err: +unlock: mutex_unlock(&ar->conf_mutex); return ret;
ath11k_peer_create() is called without its return value being checked, meaning errors will be unhandled. Add missing check and, as the mutex is unconditionally unlocked on leaving this function, simplify the exit path. Addresses-Coverity-ID: 1497531 ("Code maintainability issues") Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") Signed-off-by: Alex Dewar <alex.dewar90@gmail.com> --- drivers/net/wireless/ath/ath11k/mac.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)