| Message ID | 20221109133237.3273558-1-yangyingliang@huawei.com |
|---|---|
| State | New |
| Headers | show |
| Series | mmc: wbsd: fix return value check of mmc_add_host() | expand |
On Wed, 9 Nov 2022 at 14:34, Yang Yingliang <yangyingliang@huawei.com> wrote: > > mmc_add_host() may return error, if we ignore its return value, > it will lead two issues: > 1. The memory that allocated in mmc_alloc_host() is leaked. > 2. In the remove() path, mmc_remove_host() will be called to > delete device, but it's not added yet, it will lead a kernel > crash because of null-ptr-deref in device_del(). > > > So fix this by checking the return value and goto error path which > will call mmc_free_host(), besides, other resources also need be > released. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Applied for next, thanks! Kind regards Uffe > --- > drivers/mmc/host/wbsd.c | 12 +++++++++++- > 1 file changed, 11 insertions(+), 1 deletion(-) > > diff --git a/drivers/mmc/host/wbsd.c b/drivers/mmc/host/wbsd.c > index 67ecd342fe5f..7c7ec8d10232 100644 > --- a/drivers/mmc/host/wbsd.c > +++ b/drivers/mmc/host/wbsd.c > @@ -1698,7 +1698,17 @@ static int wbsd_init(struct device *dev, int base, int irq, int dma, > */ > wbsd_init_device(host); > > - mmc_add_host(mmc); > + ret = mmc_add_host(mmc); > + if (ret) { > + if (!pnp) > + wbsd_chip_poweroff(host); > + > + wbsd_release_resources(host); > + wbsd_free_mmc(dev); > + > + mmc_free_host(mmc); > + return ret; > + } > > pr_info("%s: W83L51xD", mmc_hostname(mmc)); > if (host->chip_id != 0) > -- > 2.25.1 >
diff --git a/drivers/mmc/host/wbsd.c b/drivers/mmc/host/wbsd.c index 67ecd342fe5f..7c7ec8d10232 100644 --- a/drivers/mmc/host/wbsd.c +++ b/drivers/mmc/host/wbsd.c @@ -1698,7 +1698,17 @@ static int wbsd_init(struct device *dev, int base, int irq, int dma, */ wbsd_init_device(host); - mmc_add_host(mmc); + ret = mmc_add_host(mmc); + if (ret) { + if (!pnp) + wbsd_chip_poweroff(host); + + wbsd_release_resources(host); + wbsd_free_mmc(dev); + + mmc_free_host(mmc); + return ret; + } pr_info("%s: W83L51xD", mmc_hostname(mmc)); if (host->chip_id != 0)
mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, other resources also need be released. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- drivers/mmc/host/wbsd.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)