From e3ea1b4847e49234e691c0d66bf030bd65bb7f2b Mon Sep 17 00:00:00 2001 From: Yang Yingliang Date: Sat, 12 Nov 2022 17:25:41 +0800 Subject: pcmcia: cs: fix possible hung task and memory leak pccardd() If device_register() returns error in pccardd(), it leads two issues: 1. The socket_released has never been completed, it will block pcmcia_unregister_socket(), because of waiting for completion of socket_released. 2. The device name allocated by dev_set_name() is leaked. Fix this two issues by calling put_device() when device_register() fails. socket_released can be completed in pcmcia_release_socket(), the name can be freed in kobject_cleanup(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang Signed-off-by: Dominik Brodowski --- drivers/pcmcia/cs.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/pcmcia') diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c index 5658745c398f..b33be1e63c98 100644 --- a/drivers/pcmcia/cs.c +++ b/drivers/pcmcia/cs.c @@ -605,6 +605,7 @@ static int pccardd(void *__skt) dev_warn(&skt->dev, "PCMCIA: unable to register socket\n"); skt->thread = NULL; complete(&skt->thread_done); + put_device(&skt->dev); return 0; } ret = pccard_sysfs_add_socket(&skt->dev); -- cgit v1.2.3 From 402ab979b29126068e0b596b641422ff7490214c Mon Sep 17 00:00:00 2001 From: Yang Yingliang Date: Sat, 12 Nov 2022 17:29:23 +0800 Subject: pcmcia: ds: fix refcount leak in pcmcia_device_add() As the comment of device_register() says, it should use put_device() to give up the reference in the error path. Then, insofar resources will be freed in pcmcia_release_dev(), the error path is no longer needed. In particular, this means that the (previously missing) dropping of the reference to &p_dev->function_config->ref is now handled by pcmcia_release_dev(). Fixes: 360b65b95bae ("[PATCH] pcmcia: make config_t independent, add reference counting") Signed-off-by: Yang Yingliang [linux@dominikbrodowski.net: simplification, commit message rewrite] Signed-off-by: Dominik Brodowski --- drivers/pcmcia/ds.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'drivers/pcmcia') diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c index d500e5dbbc3f..c90c68dee1e4 100644 --- a/drivers/pcmcia/ds.c +++ b/drivers/pcmcia/ds.c @@ -573,8 +573,14 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s, pcmcia_device_query(p_dev); - if (device_register(&p_dev->dev)) - goto err_unreg; + if (device_register(&p_dev->dev)) { + mutex_lock(&s->ops_mutex); + list_del(&p_dev->socket_device_list); + s->device_count--; + mutex_unlock(&s->ops_mutex); + put_device(&p_dev->dev); + return NULL; + } return p_dev; -- cgit v1.2.3 From 99e1241049a92dd3e9a90a0f91e32ce390133278 Mon Sep 17 00:00:00 2001 From: Yang Yingliang Date: Sat, 12 Nov 2022 17:29:24 +0800 Subject: pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically. Therefore, it needs to be freed, which is done by the driver core for us once all references to the device are gone. Therefore, move the dev_set_name() call immediately before the call device_register(), which either succeeds (then the freeing will be done upon subsequent remvoal), or puts the reference in the error call. Also, it is not unusual that the return value of dev_set_name is not checked. Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array") Signed-off-by: Yang Yingliang [linux@dominikbrodowski.net: simplification, commit message modified] Signed-off-by: Dominik Brodowski --- drivers/pcmcia/ds.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'drivers/pcmcia') diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c index c90c68dee1e4..b4b8363d1de2 100644 --- a/drivers/pcmcia/ds.c +++ b/drivers/pcmcia/ds.c @@ -513,9 +513,6 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s, /* by default don't allow DMA */ p_dev->dma_mask = 0; p_dev->dev.dma_mask = &p_dev->dma_mask; - dev_set_name(&p_dev->dev, "%d.%d", p_dev->socket->sock, p_dev->device_no); - if (!dev_name(&p_dev->dev)) - goto err_free; p_dev->devname = kasprintf(GFP_KERNEL, "pcmcia%s", dev_name(&p_dev->dev)); if (!p_dev->devname) goto err_free; @@ -573,6 +570,7 @@ static struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s, pcmcia_device_query(p_dev); + dev_set_name(&p_dev->dev, "%d.%d", p_dev->socket->sock, p_dev->device_no); if (device_register(&p_dev->dev)) { mutex_lock(&s->ops_mutex); list_del(&p_dev->socket_device_list); -- cgit v1.2.3 From 99e25b17d2a3e3b486b4f6f90a740d51245da1f2 Mon Sep 17 00:00:00 2001 From: Dongliang Mu Date: Wed, 16 Nov 2022 09:45:50 +0800 Subject: pcmcia: typo fix themselfves -> themselves Signed-off-by: Dongliang Mu Signed-off-by: Dominik Brodowski --- drivers/pcmcia/pcmcia_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/pcmcia') diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c index d78091e79a0f..e9e31c638a67 100644 --- a/drivers/pcmcia/pcmcia_resource.c +++ b/drivers/pcmcia/pcmcia_resource.c @@ -684,7 +684,7 @@ EXPORT_SYMBOL(pcmcia_request_io); * pcmcia_request_irq() is a wrapper around request_irq() which allows * the PCMCIA core to clean up the registration in pcmcia_disable_device(). * Drivers are free to use request_irq() directly, but then they need to - * call free_irq() themselfves, too. Also, only %IRQF_SHARED capable IRQ + * call free_irq() themselves, too. Also, only %IRQF_SHARED capable IRQ * handlers are allowed. */ int __must_check pcmcia_request_irq(struct pcmcia_device *p_dev, -- cgit v1.2.3 From 4f733de8b78a209501041a4b0a44c83ece0e8933 Mon Sep 17 00:00:00 2001 From: lizhe Date: Tue, 20 Dec 2022 22:37:49 -0800 Subject: pcmcia: tcic: remove unneeded "&" in call to setup_timer() The second parameter is the entry address of the function, and therefore does not require an "&". Signed-off-by: lizhe [linux@dominikbrodowski.net: update commit message] Signed-off-by: Dominik Brodowski --- drivers/pcmcia/tcic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/pcmcia') diff --git a/drivers/pcmcia/tcic.c b/drivers/pcmcia/tcic.c index 1a0e3f098759..5ef888688e23 100644 --- a/drivers/pcmcia/tcic.c +++ b/drivers/pcmcia/tcic.c @@ -435,7 +435,7 @@ static int __init init_tcic(void) } /* Set up polling */ - timer_setup(&poll_timer, &tcic_timer, 0); + timer_setup(&poll_timer, tcic_timer, 0); /* Build interrupt mask */ printk(KERN_CONT ", %d sockets\n", sockets); -- cgit v1.2.3