[PATCH] net: ethernet: mvneta: Fix error handling in mvneta_probe

2020-12-20 Thread Dinghao Liu 
When mvneta_port_power_up() fails, we should execute
cleanup functions after label err_netdev to avoid memleak.

Fixes: 41c2b6b4f0f80 ("net: ethernet: mvneta: Add back interface mode 
validation")
Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/marvell/mvneta.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/mvneta.c 
b/drivers/net/ethernet/marvell/mvneta.c
index 563ceac3060f..3369ec717a51 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -5255,7 +5255,7 @@ static int mvneta_probe(struct platform_device *pdev)
err = mvneta_port_power_up(pp, pp->phy_interface);
if (err < 0) {
dev_err(&pdev->dev, "can't power up port\n");
-   return err;
+   goto err_netdev;
}
 
/* Armada3700 network controller does not support per-cpu
-- 
2.17.1

[PATCH] net/mlx5e: Fix two double free cases

2020-12-21 Thread Dinghao Liu 
mlx5e_create_ttc_table_groups() frees ft->g on failure of
kvzalloc(), but such failure will be caught by its caller
in mlx5e_create_ttc_table() and ft->g will be freed again
in mlx5e_destroy_flow_table(). The same issue also occurs
in mlx5e_create_ttc_table_groups().

Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 8 ++--
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c 
b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index fa8149f6eb08..63323c5b6a50 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -940,10 +940,8 @@ static int mlx5e_create_ttc_table_groups(struct 
mlx5e_ttc_table *ttc,
if (!ft->g)
return -ENOMEM;
in = kvzalloc(inlen, GFP_KERNEL);
-   if (!in) {
-   kfree(ft->g);
+   if (!in)
return -ENOMEM;
-   }
 
/* L4 Group */
mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);
@@ -1085,10 +1083,8 @@ static int mlx5e_create_inner_ttc_table_groups(struct 
mlx5e_ttc_table *ttc)
if (!ft->g)
return -ENOMEM;
in = kvzalloc(inlen, GFP_KERNEL);
-   if (!in) {
-   kfree(ft->g);
+   if (!in)
return -ENOMEM;
-   }
 
/* L4 Group */
mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);
-- 
2.17.1

[PATCH] net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups

2020-12-21 Thread Dinghao Liu 
When mlx5_create_flow_group() fails, ft->g should be
freed just like when kvzalloc() fails. The caller of
mlx5e_create_l2_table_groups() does not catch this
issue on failure, which leads to memleak.

Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c 
b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index fa8149f6eb08..72de1009b104 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -1390,6 +1390,7 @@ static int mlx5e_create_l2_table_groups(struct 
mlx5e_l2_table *l2_table)
ft->g[ft->num_groups] = NULL;
mlx5e_destroy_groups(ft);
kvfree(in);
+   kfree(ft->g);
 
return err;
 }
-- 
2.17.1

[PATCH] net: ethernet: Fix memleak in ethoc_probe

2020-12-23 Thread Dinghao Liu 
When mdiobus_register() fails, priv->mdio allocated
by mdiobus_alloc() has not been freed, which leads
to memleak.

Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/ethoc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index 0981fe9652e5..3d9b0b161e24 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -1211,7 +1211,7 @@ static int ethoc_probe(struct platform_device *pdev)
ret = mdiobus_register(priv->mdio);
if (ret) {
dev_err(&netdev->dev, "failed to register MDIO bus\n");
-   goto free2;
+   goto free3;
}
 
ret = ethoc_mdio_probe(netdev);
@@ -1243,6 +1243,7 @@ static int ethoc_probe(struct platform_device *pdev)
netif_napi_del(&priv->napi);
 error:
mdiobus_unregister(priv->mdio);
+free3:
mdiobus_free(priv->mdio);
 free2:
clk_disable_unprepare(priv->clk);
-- 
2.17.1

[PATCH] enic: Remove redundant free in enic_set_ringparam

2020-12-23 Thread Dinghao Liu 
The error handling paths in enic_alloc_vnic_resources()
have called enic_free_vnic_resources() before returning.
So we may not need to call it again on failure at caller
side.

Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/cisco/enic/enic_ethtool.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/ethernet/cisco/enic/enic_ethtool.c 
b/drivers/net/ethernet/cisco/enic/enic_ethtool.c
index 1a9803f2073e..85a139d39f27 100644
--- a/drivers/net/ethernet/cisco/enic/enic_ethtool.c
+++ b/drivers/net/ethernet/cisco/enic/enic_ethtool.c
@@ -235,7 +235,6 @@ static int enic_set_ringparam(struct net_device *netdev,
if (err) {
netdev_err(netdev,
   "Failed to alloc vNIC resources, aborting\n");
-   enic_free_vnic_resources(enic);
goto err_out;
}
enic_init_vnic_resources(enic);
-- 
2.17.1

Re: Re: [PATCH] enic: Remove redundant free in enic_set_ringparam

2020-12-24 Thread dinghao . liu 
> On Wed, 23 Dec 2020 20:38:33 +0800 Dinghao Liu wrote:
> > The error handling paths in enic_alloc_vnic_resources()
> > have called enic_free_vnic_resources() before returning.
> > So we may not need to call it again on failure at caller
> > side.
> > 
> > Signed-off-by: Dinghao Liu 
> 
> But it's harmless, right? So the patch is just a cleanup not a fix?
> 

I think it's harmless. Since there is a check every time before freeing,
calling enic_free_vnic_resources() twice has no security issue.

> In that case, could you please repost in two weeks? We're currently 
> in the merge window period, we're only accepting fixes to the
> networking trees.
> 
> Thanks!

Re: Re: [PATCH] net/mlx5e: Fix two double free cases

2020-12-27 Thread dinghao . liu 
> On Mon, Dec 21, 2020 at 04:50:31PM +0800, Dinghao Liu wrote:
> > mlx5e_create_ttc_table_groups() frees ft->g on failure of
> > kvzalloc(), but such failure will be caught by its caller
> > in mlx5e_create_ttc_table() and ft->g will be freed again
> > in mlx5e_destroy_flow_table(). The same issue also occurs
> > in mlx5e_create_ttc_table_groups().
> >
> > Signed-off-by: Dinghao Liu 
> > ---
> >  drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 8 ++--
> >  1 file changed, 2 insertions(+), 6 deletions(-)
> 
> I'm not thrilled to see release in the error flow that will be done in
> the different function. The missing piece is "ft->g = NULL" after kfree().
> 
> And also fixes lines are missing in all your patches.
> 

Thank you for your advice! I will resend a new patch soon.

Regards,
Dinghao

[PATCH] [v2] net/mlx5e: Fix two double free cases

2020-12-28 Thread Dinghao Liu 
mlx5e_create_ttc_table_groups() frees ft->g on failure of
kvzalloc(), but such failure will be caught by its caller
in mlx5e_create_ttc_table() and ft->g will be freed again
in mlx5e_destroy_flow_table(). The same issue also occurs
in mlx5e_create_ttc_table_groups(). Set ft->g to NULL after
kfree() to avoid double free.

Fixes: 7b3722fa9ef64 ("net/mlx5e: Support RSS for GRE tunneled packets")
Fixes: 33cfaaa8f36ff ("net/mlx5e: Split the main flow steering table")
Signed-off-by: Dinghao Liu 
---

Changelog:

v2: - Set ft->g to NULL after kfree() instead of removing kfree().
  Refine commit message.
---
 drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c 
b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index fa8149f6eb08..44a2dfbc3853 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -942,6 +942,7 @@ static int mlx5e_create_ttc_table_groups(struct 
mlx5e_ttc_table *ttc,
in = kvzalloc(inlen, GFP_KERNEL);
if (!in) {
kfree(ft->g);
+   ft->g = NULL;
return -ENOMEM;
}
 
@@ -1087,6 +1088,7 @@ static int mlx5e_create_inner_ttc_table_groups(struct 
mlx5e_ttc_table *ttc)
in = kvzalloc(inlen, GFP_KERNEL);
if (!in) {
kfree(ft->g);
+   ft->g = NULL;
return -ENOMEM;
}
 
-- 
2.17.1

[PATCH] net: ixgbe: Fix memleak in ixgbe_configure_clsu32

2021-01-03 Thread Dinghao Liu 
When ixgbe_fdir_write_perfect_filter_82599() fails,
input allocated by kzalloc() has not been freed,
which leads to memleak.

Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c 
b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 393d1c2cd853..e9c2d28efc81 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -9582,8 +9582,10 @@ static int ixgbe_configure_clsu32(struct ixgbe_adapter 
*adapter,
ixgbe_atr_compute_perfect_hash_82599(&input->filter, mask);
err = ixgbe_fdir_write_perfect_filter_82599(hw, &input->filter,
input->sw_idx, queue);
-   if (!err)
-   ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
+   if (err)
+   goto err_out_w_lock;
+
+   ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
spin_unlock(&adapter->fdir_perfect_lock);
 
if ((uhtid != 0x800) && (adapter->jump_tables[uhtid]))
-- 
2.17.1

Re: Re: [Intel-wired-lan] [PATCH] net: ixgbe: Fix memleak in ixgbe_configure_clsu32

2021-01-03 Thread dinghao . liu 
> Dear Dinghao,
> 
> 
> Am 03.01.21 um 09:08 schrieb Dinghao Liu:
> > When ixgbe_fdir_write_perfect_filter_82599() fails,
> > input allocated by kzalloc() has not been freed,
> > which leads to memleak.
> 
> Nice find. Thank you for your patches. Out of curiosity, do you use an 
> analysis tool to find these issues?
> 

Yes, these bugs are suggested by my static analysis tool. 

> > Signed-off-by: Dinghao Liu 
> > ---
> >   drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 --
> >   1 file changed, 4 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c 
> > b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> > index 393d1c2cd853..e9c2d28efc81 100644
> > --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> > +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> > @@ -9582,8 +9582,10 @@ static int ixgbe_configure_clsu32(struct 
> > ixgbe_adapter *adapter,
> > ixgbe_atr_compute_perfect_hash_82599(&input->filter, mask);
> > err = ixgbe_fdir_write_perfect_filter_82599(hw, &input->filter,
> > input->sw_idx, queue);
> > -   if (!err)
> > -   ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
> > +   if (err)
> > +   goto err_out_w_lock;
> > +
> > +   ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
> > spin_unlock(&adapter->fdir_perfect_lock);
> >   
> > if ((uhtid != 0x800) && (adapter->jump_tables[uhtid]))
> 
> Reviewed-by: Paul Menzel 
> 
> I wonder, in the non-error case, how `input` and `jump` are freed.
> 

I'm not sure if kfree(jump) will introduce bug. jump is allocated in a for 
loop and has been passed to adapter->jump_tables. input and mask have new
definitions (kzalloc) after this loop, it's reasonable to free them on failure.
But jump is different. Maybe we should not free jump after the loop?

> Old code:
> 
> > if (!err)
> > ixgbe_update_ethtool_fdir_entry(adapter, input, 
> > input->sw_idx);
> > spin_unlock(&adapter->fdir_perfect_lock);
> > 
> > if ((uhtid != 0x800) && (adapter->jump_tables[uhtid]))
> > set_bit(loc - 1, 
> > (adapter->jump_tables[uhtid])->child_loc_map);
> > 
> > kfree(mask);
> > return err;
> 
> Should these two lines be replaced with `goto err_out`? (Though the name 
> is confusing then, as it’s the non-error case.)
> 

This also makes me confused. It seems that the check against untied is not error
handling code, but there is a kfree(mask) after it. Freeing allocated data on
success is not reasonable. 

Regards,
Dinghao

> > err_out_w_lock:
> > spin_unlock(&adapter->fdir_perfect_lock);
> > err_out:
> > kfree(mask);
> > free_input:
> > kfree(input);
> > free_jump:
> > kfree(jump);
> > return err;
> > }
> 
> Kind regards,
> 
> Paul

Re: Re: [PATCH] net: ethernet: Fix memleak in ethoc_probe

2021-01-06 Thread dinghao . liu 
> On Mon, 28 Dec 2020 16:14:17 -0500 Konstantin Ryabitsev wrote:
> > On Mon, Dec 28, 2020 at 01:05:26PM -0800, Florian Fainelli wrote:
> > > On 12/28/2020 12:23 PM, Konstantin Ryabitsev wrote:  
> > > > On Thu, Dec 24, 2020 at 01:57:40PM -0800, Florian Fainelli wrote:  
> > >  Konstantin, would you be willing to mod the kernel.org instance of
> > >  patchwork to populate Fixes tags in the generated mboxes?  
> > > >>>
> > > >>> I'd really rather not -- we try not to diverge from project upstream 
> > > >>> if at all
> > > >>> possible, as this dramatically complicates upgrades.  
> > > >>
> > > >> Well that is really unfortunate then because the Linux developer
> > > >> community settled on using the Fixes: tag for years now and having
> > > >> patchwork automatically append those tags would greatly help 
> > > >> maintainers.  
> > > > 
> > > > I agree -- but this is something that needs to be implemented upstream.
> > > > Picking up a one-off patch just for patchwork.kernel.org is not the 
> > > > right way
> > > > to go about this.  
> > > 
> > > You should be able to tune this from the patchwork administrative
> > > interface and add new tags there, would not that be acceptable?  
> > 
> > Oh, oops, I got confused by the mention of a rejected upstream patch -- I
> > didn't realize that this is already possible with a configuration setting.
> > 
> > Sure, I added a match for ^Fixes: -- let me know if it's not doing the right
> > thing.
> 
> I used this one for a test:
> 
> https://patchwork.kernel.org/project/netdevbpf/patch/1609312994-121032-1-git-send-email-abaci-bug...@linux.alibaba.com/
> 
> I'm not getting the Fixes tag when I download the mbox.

It seems that automatically generating Fixes tags is a hard work.
Both patches and bugs could be complex. Sometimes even human cannot
determine which commit introduced a target bug.

Is this an already implemented functionality?

Regards,
Dinghao

Re: Re: [PATCH] net: ethernet: Fix memleak in ethoc_probe

2021-01-06 Thread dinghao . liu 
> On Wed, 6 Jan 2021 18:56:23 +0800 (GMT+08:00) dinghao@zju.edu.cn
> wrote:
> > > I used this one for a test:
> > > 
> > > https://patchwork.kernel.org/project/netdevbpf/patch/1609312994-121032-1-git-send-email-abaci-bug...@linux.alibaba.com/
> > > 
> > > I'm not getting the Fixes tag when I download the mbox.  
> > 
> > It seems that automatically generating Fixes tags is a hard work.
> > Both patches and bugs could be complex. Sometimes even human cannot
> > determine which commit introduced a target bug.
> > 
> > Is this an already implemented functionality?
> 
> I'm not sure I understand. Indeed finding the right commit to use in 
> a Fixes tag is not always easy, and definitely not easy to automate.
> Human validation is always required.
> 
> If we could easily automate finding the commit which introduced a
> problem we wouldn't need to add the explicit tag, backporters could
> just run such script locally.. That's why it's best if the author 
> does the digging and provides the right tag.
> 
> The conversation with Konstantin and Florian was about automatically
> picking up Fixes tags from the mailing list by the patchwork software,
> when such tags are posted in reply to the original posting, just like
> review tags. But the tags are still generated by humans.

It's clear to me, thanks.

Regards,
Dinghao

[PATCH] netfilter: Fix memleak in nf_nat_init

2021-01-09 Thread Dinghao Liu 
When register_pernet_subsys() fails, nf_nat_bysource
should be freed just like when nf_ct_extend_register()
fails.

Fixes: 1cd472bf036ca ("netfilter: nf_nat: add nat hook register functions to 
nf_nat")
Signed-off-by: Dinghao Liu 
---
 net/netfilter/nf_nat_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index ea923f8cf9c4..b7c3c902290f 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -1174,6 +1174,7 @@ static int __init nf_nat_init(void)
ret = register_pernet_subsys(&nat_net_ops);
if (ret < 0) {
nf_ct_extend_unregister(&nat_extend);
+   kvfree(nf_nat_bysource);
return ret;
}
 
-- 
2.17.1

[PATCH] can: vxcan: Fix memleak in vxcan_newlink

2020-10-20 Thread Dinghao Liu 
When rtnl_configure_link() fails, peer needs to be
freed just like when register_netdevice() fails.

Signed-off-by: Dinghao Liu 
---
 drivers/net/can/vxcan.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
index d6ba9426be4d..aefc5a61d239 100644
--- a/drivers/net/can/vxcan.c
+++ b/drivers/net/can/vxcan.c
@@ -244,6 +244,7 @@ static int vxcan_newlink(struct net *net, struct net_device 
*dev,
 
 unregister_network_device:
unregister_netdevice(peer);
+   free_netdev(peer);
return err;
 }
 
-- 
2.17.1

Re: Re: [PATCH] can: vxcan: Fix memleak in vxcan_newlink

2020-10-21 Thread dinghao . liu 
> 
> On 21.10.20 07:21, Dinghao Liu wrote:
> > When rtnl_configure_link() fails, peer needs to be
> > freed just like when register_netdevice() fails.
> > 
> > Signed-off-by: Dinghao Liu 
> 
> Acked-by: Oliver Hartkopp 
> 
> Btw. as the vxcan.c driver bases on veth.c the same issue can be found 
> there!
> 
> At this point:
> https://elixir.bootlin.com/linux/latest/source/drivers/net/veth.c#L1398
> 
> err_register_dev:
>  /* nothing to do */
> err_configure_peer:
>  unregister_netdevice(peer);
>  return err; <<<<<<<<<<<<<<<<<<<<<<<
> 
> err_register_peer:
>  free_netdev(peer);
>  return err;
> }
> 
> IMO the return must be removed to fall through the next label and free 
> the netdevice too.
> 
> Would you like so send a patch for veth.c too?
> 

Sure.

Regards,
Dinghao

[PATCH] net-veth: Fix memleak in veth_newlink

2020-10-21 Thread Dinghao Liu 
When rtnl_configure_link() fails, peer needs to be
freed just like when register_netdevice() fails.

Signed-off-by: Dinghao Liu 
---
 drivers/net/veth.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 8c737668008a..6c68094399cc 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -1405,8 +1405,6 @@ static int veth_newlink(struct net *src_net, struct 
net_device *dev,
/* nothing to do */
 err_configure_peer:
unregister_netdevice(peer);
-   return err;
-
 err_register_peer:
free_netdev(peer);
return err;
-- 
2.17.1

[PATCH] e1000e: Fix error handling in e1000_set_d0_lplu_state_82571

2021-02-28 Thread Dinghao Liu 
There is one e1e_wphy() call in e1000_set_d0_lplu_state_82571
that we have caught its return value but lack further handling.
Check and terminate the execution flow just like other e1e_wphy()
in this function.

Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/intel/e1000e/82571.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/intel/e1000e/82571.c 
b/drivers/net/ethernet/intel/e1000e/82571.c
index 88faf05e23ba..0b1e890dd583 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -899,6 +899,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw 
*hw, bool active)
} else {
data &= ~IGP02E1000_PM_D0_LPLU;
ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data);
+   if (ret_val)
+   return ret_val;
/* LPLU and SmartSpeed are mutually exclusive.  LPLU is used
 * during Dx states where the power conservation is most
 * important.  During driver activity we should enable
-- 
2.17.1

[PATCH] i40e: Fix error handling in i40e_vsi_open

2021-02-28 Thread Dinghao Liu 
When vsi->type == I40E_VSI_FDIR, we have caught the return value of
i40e_vsi_request_irq() but without further handling. Check and execute
memory clean on failure just like the other i40e_vsi_request_irq().

Fixes: 8a9eb7d3cbcab ("i40e: rework fdir setup and teardown")
Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/intel/i40e/i40e_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c 
b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 353deae139f9..c3bbc1310f8e 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -8724,6 +8724,8 @@ int i40e_vsi_open(struct i40e_vsi *vsi)
 dev_driver_string(&pf->pdev->dev),
 dev_name(&pf->pdev->dev));
err = i40e_vsi_request_irq(vsi, int_name);
+   if (err)
+   goto err_setup_rx;
 
} else {
err = -EINVAL;
-- 
2.17.1

[PATCH] iwlegacy: Add missing check in il4965_commit_rxon

2021-02-28 Thread Dinghao Liu 
There is one il_set_tx_power() call in this function without
return value check. Print error message and return error code
on failure just like the other il_set_tx_power() call.

Signed-off-by: Dinghao Liu 
---
 drivers/net/wireless/intel/iwlegacy/4965.c | 6 +-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlegacy/4965.c 
b/drivers/net/wireless/intel/iwlegacy/4965.c
index 9fa556486511..3235b8be1894 100644
--- a/drivers/net/wireless/intel/iwlegacy/4965.c
+++ b/drivers/net/wireless/intel/iwlegacy/4965.c
@@ -1361,7 +1361,11 @@ il4965_commit_rxon(struct il_priv *il)
 * We do not commit tx power settings while channel changing,
 * do it now if tx power changed.
 */
-   il_set_tx_power(il, il->tx_power_next, false);
+   ret = il_set_tx_power(il, il->tx_power_next, false);
+   if (ret) {
+   IL_ERR("Error sending TX power (%d)\n", ret);
+   return ret;
+   }
return 0;
}
 
-- 
2.17.1

Re: Re: [PATCH] iwlegacy: Add missing check in il4965_commit_rxon

2021-02-28 Thread dinghao . liu 
> On Sun, Feb 28, 2021 at 08:25:22PM +0800, Dinghao Liu wrote:
> > There is one il_set_tx_power() call in this function without
> > return value check. Print error message and return error code
> > on failure just like the other il_set_tx_power() call.
> 
> We have few calls for il_set_tx_power(), on some cases we
> check return on some not. That correct as setting tx power
> can be deferred internally if not possible at the moment.
> 
> > Signed-off-by: Dinghao Liu 
> > ---
> >  drivers/net/wireless/intel/iwlegacy/4965.c | 6 +-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/net/wireless/intel/iwlegacy/4965.c 
> > b/drivers/net/wireless/intel/iwlegacy/4965.c
> > index 9fa556486511..3235b8be1894 100644
> > --- a/drivers/net/wireless/intel/iwlegacy/4965.c
> > +++ b/drivers/net/wireless/intel/iwlegacy/4965.c
> > @@ -1361,7 +1361,11 @@ il4965_commit_rxon(struct il_priv *il)
> >  * We do not commit tx power settings while channel changing,
> >  * do it now if tx power changed.
> >  */
> > -   il_set_tx_power(il, il->tx_power_next, false);
> > +   ret = il_set_tx_power(il, il->tx_power_next, false);
> > +   if (ret) {
> > +   IL_ERR("Error sending TX power (%d)\n", ret);
> > +   return ret;
> > +   
> 
> This is not good change. We do not check return value of
> il_commit_rxon(), except when creating interface. So this change might
> broke creating interface, what worked otherwise when il_set_tx_power()
> returned error.
> 

It's clear to me, Thanks for your explanation!

Regards,
Dinghao

[PATCH] hostap: Fix memleak in prism2_config

2021-03-29 Thread Dinghao Liu 
When prism2_hw_config() fails, we just return an error code
without any resource release, which may lead to memleak.

Signed-off-by: Dinghao Liu 
---
 drivers/net/wireless/intersil/hostap/hostap_cs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/intersil/hostap/hostap_cs.c 
b/drivers/net/wireless/intersil/hostap/hostap_cs.c
index ec7db2badc40..7dc16ab50ad6 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_cs.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_cs.c
@@ -536,10 +536,10 @@ static int prism2_config(struct pcmcia_device *link)
sandisk_enable_wireless(dev);
 
ret = prism2_hw_config(dev, 1);
-   if (!ret)
-   ret = hostap_hw_ready(dev);
+   if (ret)
+   goto failed;
 
-   return ret;
+   return hostap_hw_ready(dev);;
 
  failed:
kfree(hw_priv);
-- 
2.17.1

[PATCH] staging: wilc1000: Fix memleak in wilc_sdio_probe

2020-08-19 Thread Dinghao Liu 
When devm_clk_get() returns -EPROBE_DEFER, sdio_priv
should be freed just like when wilc_cfg80211_init()
fails.

Fixes: 8692b047e86cf ("staging: wilc1000: look for rtc_clk clock")
Signed-off-by: Dinghao Liu 
---
 drivers/net/wireless/microchip/wilc1000/sdio.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/microchip/wilc1000/sdio.c 
b/drivers/net/wireless/microchip/wilc1000/sdio.c
index 3ece7b0b0392..351ff909ab1c 100644
--- a/drivers/net/wireless/microchip/wilc1000/sdio.c
+++ b/drivers/net/wireless/microchip/wilc1000/sdio.c
@@ -149,9 +149,10 @@ static int wilc_sdio_probe(struct sdio_func *func,
wilc->dev = &func->dev;
 
wilc->rtc_clk = devm_clk_get(&func->card->dev, "rtc");
-   if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER)
+   if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER) {
+   kfree(sdio_priv);
return -EPROBE_DEFER;
-   else if (!IS_ERR(wilc->rtc_clk))
+   } else if (!IS_ERR(wilc->rtc_clk))
clk_prepare_enable(wilc->rtc_clk);
 
dev_info(&func->dev, "Driver Initializing success\n");
-- 
2.17.1

[PATCH] staging: wilc1000: Fix memleak in wilc_bus_probe

2020-08-19 Thread Dinghao Liu 
When devm_clk_get() returns -EPROBE_DEFER, spi_priv
should be freed just like when wilc_cfg80211_init()
fails.

Fixes: 854d66df74aed ("staging: wilc1000: look for rtc_clk clock in spi mode")
Signed-off-by: Dinghao Liu 
---
 drivers/net/wireless/microchip/wilc1000/spi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/microchip/wilc1000/spi.c 
b/drivers/net/wireless/microchip/wilc1000/spi.c
index 3f19e3f38a39..a18dac0aa6b6 100644
--- a/drivers/net/wireless/microchip/wilc1000/spi.c
+++ b/drivers/net/wireless/microchip/wilc1000/spi.c
@@ -112,9 +112,10 @@ static int wilc_bus_probe(struct spi_device *spi)
wilc->dev_irq_num = spi->irq;
 
wilc->rtc_clk = devm_clk_get(&spi->dev, "rtc_clk");
-   if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER)
+   if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER) {
+   kfree(spi_priv);
return -EPROBE_DEFER;
-   else if (!IS_ERR(wilc->rtc_clk))
+   } else if (!IS_ERR(wilc->rtc_clk))
clk_prepare_enable(wilc->rtc_clk);
 
return 0;
-- 
2.17.1

Re: Re: [PATCH] staging: wilc1000: Fix memleak in wilc_sdio_probe

2020-08-19 Thread dinghao . liu 


ajay.kat...@microchip.com写道：
> Thanks for submitting the patch. The code changes looks okay to me.
> 
> The driver is now moved out of staging so 'staging' prefix is not
> required in subject. For future patches on wilc driver, the 'staging'
> prefix can be removed.
> 
> For this patch, I am not sure if Kalle can apply as is otherwise please
> submit a patch by removing 'staging' from subject so it can be applied
> directly.
> 
> Regards,
> Ajay
> 

Thanks for your correction. I'll send a new patch soon.

Regards,
Dinghao

[PATCH] [v2] wilc1000: Fix memleak in wilc_sdio_probe

2020-08-19 Thread Dinghao Liu 
When devm_clk_get() returns -EPROBE_DEFER, sdio_priv
should be freed just like when wilc_cfg80211_init()
fails.

Fixes: 8692b047e86cf ("staging: wilc1000: look for rtc_clk clock")
Signed-off-by: Dinghao Liu 
---

Changelog:

v2: - Remove 'staging' prefix in subject.
---
 drivers/net/wireless/microchip/wilc1000/sdio.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/microchip/wilc1000/sdio.c 
b/drivers/net/wireless/microchip/wilc1000/sdio.c
index 3ece7b0b0392..351ff909ab1c 100644
--- a/drivers/net/wireless/microchip/wilc1000/sdio.c
+++ b/drivers/net/wireless/microchip/wilc1000/sdio.c
@@ -149,9 +149,10 @@ static int wilc_sdio_probe(struct sdio_func *func,
wilc->dev = &func->dev;
 
wilc->rtc_clk = devm_clk_get(&func->card->dev, "rtc");
-   if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER)
+   if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER) {
+   kfree(sdio_priv);
return -EPROBE_DEFER;
-   else if (!IS_ERR(wilc->rtc_clk))
+   } else if (!IS_ERR(wilc->rtc_clk))
clk_prepare_enable(wilc->rtc_clk);
 
dev_info(&func->dev, "Driver Initializing success\n");
-- 
2.17.1

[PATCH] [v2] wilc1000: Fix memleak in wilc_bus_probe

2020-08-19 Thread Dinghao Liu 
When devm_clk_get() returns -EPROBE_DEFER, spi_priv
should be freed just like when wilc_cfg80211_init()
fails.

Fixes: 854d66df74aed ("staging: wilc1000: look for rtc_clk clock in spi mode")
Signed-off-by: Dinghao Liu 
---

Changelog:

v2: - Remove 'staging' prefix in subject.
---
 drivers/net/wireless/microchip/wilc1000/spi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/microchip/wilc1000/spi.c 
b/drivers/net/wireless/microchip/wilc1000/spi.c
index 3f19e3f38a39..a18dac0aa6b6 100644
--- a/drivers/net/wireless/microchip/wilc1000/spi.c
+++ b/drivers/net/wireless/microchip/wilc1000/spi.c
@@ -112,9 +112,10 @@ static int wilc_bus_probe(struct spi_device *spi)
wilc->dev_irq_num = spi->irq;
 
wilc->rtc_clk = devm_clk_get(&spi->dev, "rtc_clk");
-   if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER)
+   if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER) {
+   kfree(spi_priv);
return -EPROBE_DEFER;
-   else if (!IS_ERR(wilc->rtc_clk))
+   } else if (!IS_ERR(wilc->rtc_clk))
clk_prepare_enable(wilc->rtc_clk);
 
return 0;
-- 
2.17.1

[PATCH] NFC: st95hf: Fix memleak in st95hf_in_send_cmd

2020-08-23 Thread Dinghao Liu 
When down_killable() fails, skb_resp should be freed
just like when st95hf_spi_send() fails.

Signed-off-by: Dinghao Liu 
---
 drivers/nfc/st95hf/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c
index 9642971e89ce..457854765983 100644
--- a/drivers/nfc/st95hf/core.c
+++ b/drivers/nfc/st95hf/core.c
@@ -966,7 +966,7 @@ static int st95hf_in_send_cmd(struct nfc_digital_dev *ddev,
rc = down_killable(&stcontext->exchange_lock);
if (rc) {
WARN(1, "Semaphore is not found up in st95hf_in_send_cmd\n");
-   return rc;
+   goto free_skb_resp;
}
 
rc = st95hf_spi_send(&stcontext->spicontext, skb->data,
-- 
2.17.1

[PATCH] net: arc_emac: Fix memleak in arc_mdio_probe

2020-08-23 Thread Dinghao Liu 
When devm_gpiod_get_optional() fails, bus should be
freed just like when of_mdiobus_register() fails.

Fixes: 1bddd96cba03d ("net: arc_emac: support the phy reset for emac driver")
Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/arc/emac_mdio.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/arc/emac_mdio.c 
b/drivers/net/ethernet/arc/emac_mdio.c
index 0187dbf3b87d..54cdafdd067d 100644
--- a/drivers/net/ethernet/arc/emac_mdio.c
+++ b/drivers/net/ethernet/arc/emac_mdio.c
@@ -153,6 +153,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv)
if (IS_ERR(data->reset_gpio)) {
error = PTR_ERR(data->reset_gpio);
dev_err(priv->dev, "Failed to request gpio: %d\n", error);
+   mdiobus_free(bus);
return error;
}
 
-- 
2.17.1

[PATCH] firestream: Fix memleak in fs_open

2020-08-23 Thread Dinghao Liu 
When make_rate() fails, vcc should be freed just
like other error paths in fs_open().

Signed-off-by: Dinghao Liu 
---
 drivers/atm/firestream.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index 2ca9ec802734..510250cf5c87 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -998,6 +998,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
error = make_rate (pcr, r, &tmc0, NULL);
if (error) {
kfree(tc);
+   kfree(vcc);
return error;
}
}
-- 
2.17.1

[PATCH] net: hns: Fix memleak in hns_nic_dev_probe

2020-08-23 Thread Dinghao Liu 
hns_nic_dev_probe allocates ndev, but not free it on
two error handling paths, which may lead to memleak.

Fixes: 63434888aaf1b ("net: hns: net: hns: enet adds support of acpi")
Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/hisilicon/hns/hns_enet.c | 9 ++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c 
b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index 23f278e46975..22522f8a5299 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -2282,8 +2282,10 @@ static int hns_nic_dev_probe(struct platform_device 
*pdev)
priv->enet_ver = AE_VERSION_1;
else if (acpi_dev_found(hns_enet_acpi_match[1].id))
priv->enet_ver = AE_VERSION_2;
-   else
-   return -ENXIO;
+   else {
+   ret = -ENXIO;
+   goto out_read_prop_fail;
+   }
 
/* try to find port-idx-in-ae first */
ret = acpi_node_get_property_reference(dev->fwnode,
@@ -2299,7 +2301,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
priv->fwnode = args.fwnode;
} else {
dev_err(dev, "cannot read cfg data from OF or acpi\n");
-   return -ENXIO;
+   ret = -ENXIO;
+   goto out_read_prop_fail;
}
 
ret = device_property_read_u32(dev, "port-idx-in-ae", &port_id);
-- 
2.17.1

[PATCH] net: systemport: Fix memleak in bcm_sysport_probe

2020-08-23 Thread Dinghao Liu 
When devm_kcalloc() fails, dev should be freed just
like what we've done in the subsequent error paths.

Fixes: 7b78be48a8eb6 ("net: systemport: Dynamically allocate number of TX 
rings")
Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c 
b/drivers/net/ethernet/broadcom/bcmsysport.c
index dfed9ade6950..0762d5d1a810 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2491,8 +2491,10 @@ static int bcm_sysport_probe(struct platform_device 
*pdev)
priv->tx_rings = devm_kcalloc(&pdev->dev, txq,
  sizeof(struct bcm_sysport_tx_ring),
  GFP_KERNEL);
-   if (!priv->tx_rings)
-   return -ENOMEM;
+   if (!priv->tx_rings) {
+   ret = -ENOMEM;
+   goto err_free_netdev;
+   }
 
priv->is_lite = params->is_lite;
priv->num_rx_desc_words = params->num_rx_desc_words;
-- 
2.17.1

[PATCH] octeontx2-af: Fix use of uninitialized pointer bmap

2020-07-24 Thread Dinghao Liu 
If req->ctype does not match any of NIX_AQ_CTYPE_CQ,
NIX_AQ_CTYPE_SQ or NIX_AQ_CTYPE_RQ, pointer bmap will remain
uninitialized and be accessed in test_bit(), which can lead
to kernal crash.

Fix this by returning an error code if this case is triggered.

Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 9 -
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c 
b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
index 36953d4f51c7..20a64ed24474 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
@@ -869,19 +869,18 @@ static int nix_lf_hwctx_disable(struct rvu *rvu, struct 
hwctx_disable_req *req)
aq_req.cq_mask.bp_ena = 1;
q_cnt = pfvf->cq_ctx->qsize;
bmap = pfvf->cq_bmap;
-   }
-   if (req->ctype == NIX_AQ_CTYPE_SQ) {
+   } else if (req->ctype == NIX_AQ_CTYPE_SQ) {
aq_req.sq.ena = 0;
aq_req.sq_mask.ena = 1;
q_cnt = pfvf->sq_ctx->qsize;
bmap = pfvf->sq_bmap;
-   }
-   if (req->ctype == NIX_AQ_CTYPE_RQ) {
+   } else if (req->ctype == NIX_AQ_CTYPE_RQ) {
aq_req.rq.ena = 0;
aq_req.rq_mask.ena = 1;
q_cnt = pfvf->rq_ctx->qsize;
bmap = pfvf->rq_bmap;
-   }
+   } else
+   return NIX_AF_ERR_AQ_ENQUEUE;
 
aq_req.ctype = req->ctype;
aq_req.op = NIX_AQ_INSTOP_WRITE;
-- 
2.17.1

Re: Re: [PATCH] octeontx2-af: Fix use of uninitialized pointer bmap

2020-07-24 Thread dinghao . liu 
> From: Dinghao Liu 
> Date: Fri, 24 Jul 2020 16:06:57 +0800
> 
> > If req->ctype does not match any of NIX_AQ_CTYPE_CQ,
> > NIX_AQ_CTYPE_SQ or NIX_AQ_CTYPE_RQ, pointer bmap will remain
> > uninitialized and be accessed in test_bit(), which can lead
> > to kernal crash.
> 
> This can never happen.
> 
> > Fix this by returning an error code if this case is triggered.
> > 
> > Signed-off-by: Dinghao Liu 
> 
> I strongly dislike changes like this.
> 
> Most callers of nix_lf_hwctx_disable() inside of rvu_nix.c set
> req->ctype to one of the handled values.
> 
> The only other case, rvu_mbox_handler_nix_hwctx_disable(), is a
> completely unused function and should be removed.
> 
> There is no functional problem in this code at all.
> 
> It is not possible show a code path where the stated problem can
> actually occur.

It's clear to me now. Thanks.

Regards,
Dinghao

[PATCH] rxrpc: Fix memleak in rxkad_verify_response

2020-08-26 Thread Dinghao Liu 
When kmalloc() on ticket fails, response should be freed
to prevent memleak.

Signed-off-by: Dinghao Liu 
---
 net/rxrpc/rxkad.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 52a24d4ef5d8..e08130e5746b 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -1137,7 +1137,7 @@ static int rxkad_verify_response(struct rxrpc_connection 
*conn,
ret = -ENOMEM;
ticket = kmalloc(ticket_len, GFP_NOFS);
if (!ticket)
-   goto temporary_error;
+   goto temporary_error_free_resp;
 
eproto = tracepoint_string("rxkad_tkt_short");
abort_code = RXKADPACKETSHORT;
@@ -1230,6 +1230,7 @@ static int rxkad_verify_response(struct rxrpc_connection 
*conn,
 
 temporary_error_free_ticket:
kfree(ticket);
+temporary_error_free_resp:
kfree(response);
 temporary_error:
/* Ignore the response packet if we got a temporary error such as
-- 
2.17.1

[PATCH] ice: Fix memleak in ice_set_ringparam

2020-08-26 Thread Dinghao Liu 
When kcalloc() on rx_rings fails, we should free tx_rings
and xdp_rings to prevent memleak. Similarly, when
ice_alloc_rx_bufs() fails, we should free xdp_rings.

Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/intel/ice/ice_ethtool.c | 13 +++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c 
b/drivers/net/ethernet/intel/ice/ice_ethtool.c
index 9e8e9531cd87..caf64eb5e96d 100644
--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -2863,7 +2863,7 @@ ice_set_ringparam(struct net_device *netdev, struct 
ethtool_ringparam *ring)
rx_rings = kcalloc(vsi->num_rxq, sizeof(*rx_rings), GFP_KERNEL);
if (!rx_rings) {
err = -ENOMEM;
-   goto done;
+   goto free_xdp;
}
 
ice_for_each_rxq(vsi, i) {
@@ -2892,7 +2892,7 @@ ice_set_ringparam(struct net_device *netdev, struct 
ethtool_ringparam *ring)
}
kfree(rx_rings);
err = -ENOMEM;
-   goto free_tx;
+   goto free_xdp;
}
}
 
@@ -2943,6 +2943,15 @@ ice_set_ringparam(struct net_device *netdev, struct 
ethtool_ringparam *ring)
}
goto done;
 
+free_xdp:
+   if (xdp_rings) {
+   for (i = 0; i < vsi->num_xdp_txq; i++) {
+   ice_free_tx_ring(vsi->xdp_rings[i]);
+   *vsi->xdp_rings[i] = xdp_rings[i];
+   }
+   kfree(xdp_rings);
+   }
+
 free_tx:
/* error cleanup if the Rx allocations failed after getting Tx */
if (tx_rings) {
-- 
2.17.1

[PATCH] gss_krb5: Fix memleak in krb5_make_rc4_seq_num

2020-08-27 Thread Dinghao Liu 
When kmalloc() fails, cipher should be freed
just like when krb5_rc4_setup_seq_key() fails.

Fixes: e7afe6c1d486b ("sunrpc: fix 4 more call sites that were using stack 
memory with a scatterlist")
Signed-off-by: Dinghao Liu 
---
 net/sunrpc/auth_gss/gss_krb5_seqnum.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/sunrpc/auth_gss/gss_krb5_seqnum.c 
b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
index 507105127095..88ca58d11082 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seqnum.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
@@ -53,8 +53,10 @@ krb5_make_rc4_seq_num(struct krb5_ctx *kctx, int direction, 
s32 seqnum,
return PTR_ERR(cipher);
 
plain = kmalloc(8, GFP_NOFS);
-   if (!plain)
-   return -ENOMEM;
+   if (!plain) {
+   code = -ENOMEM;
+   goto out;
+   }
 
plain[0] = (unsigned char) ((seqnum >> 24) & 0xff);
plain[1] = (unsigned char) ((seqnum >> 16) & 0xff);
-- 
2.17.1

[PATCH] can: xilinx_can: fix runtime pm imbalance on error

2020-05-20 Thread Dinghao Liu 
pm_runtime_get_sync() increments the runtime PM usage counter even
the call returns an error code. Thus a pairing decrement is needed
on the error handling path to keep the counter balanced.

Signed-off-by: Dinghao Liu 
---
 drivers/net/can/xilinx_can.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
index c1dbab8c896d..a9e8184cc611 100644
--- a/drivers/net/can/xilinx_can.c
+++ b/drivers/net/can/xilinx_can.c
@@ -1823,8 +1823,8 @@ static int xcan_probe(struct platform_device *pdev)
return 0;
 
 err_disableclks:
-   pm_runtime_put(priv->dev);
 err_pmdisable:
+   pm_runtime_put(priv->dev);
pm_runtime_disable(&pdev->dev);
 err_free:
free_candev(ndev);
-- 
2.17.1

[PATCH] wlcore: fix runtime pm imbalance in wl1271_tx_work

2020-05-20 Thread Dinghao Liu 
There are two error handling paths in this functon. When
wlcore_tx_work_locked() returns an error code, we should
decrease the runtime PM usage counter the same way as the
error handling path beginning from pm_runtime_get_sync().

Signed-off-by: Dinghao Liu 
---
 drivers/net/wireless/ti/wlcore/tx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ti/wlcore/tx.c 
b/drivers/net/wireless/ti/wlcore/tx.c
index 90e56d4c3df3..e20e18cd04ae 100644
--- a/drivers/net/wireless/ti/wlcore/tx.c
+++ b/drivers/net/wireless/ti/wlcore/tx.c
@@ -863,6 +863,7 @@ void wl1271_tx_work(struct work_struct *work)
 
ret = wlcore_tx_work_locked(wl);
if (ret < 0) {
+   pm_runtime_put_noidle(wl->dev);
wl12xx_queue_recovery_work(wl);
goto out;
}
-- 
2.17.1

[PATCH] wlcore: fix runtime pm imbalance in wlcore_regdomain_config

2020-05-20 Thread Dinghao Liu 
pm_runtime_get_sync() increments the runtime PM usage counter even
the call returns an error code. Thus a pairing decrement is needed
on the error handling path to keep the counter balanced.

Signed-off-by: Dinghao Liu 
---
 drivers/net/wireless/ti/wlcore/main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ti/wlcore/main.c 
b/drivers/net/wireless/ti/wlcore/main.c
index f140f7d7f553..c7e4f5a80b9e 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -3662,8 +3662,10 @@ void wlcore_regdomain_config(struct wl1271 *wl)
goto out;
 
ret = pm_runtime_get_sync(wl->dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_autosuspend(wl->dev);
goto out;
+   }
 
ret = wlcore_cmd_regdomain_config_locked(wl);
if (ret < 0) {
-- 
2.17.1

[PATCH] wlcore: fix runtime pm imbalance in wl1271_op_suspend

2020-05-20 Thread Dinghao Liu 
When wlcore_hw_interrupt_notify() returns an error code,
a pairing runtime PM usage counter decrement is needed to
keep the counter balanced.

Signed-off-by: Dinghao Liu 
---
 drivers/net/wireless/ti/wlcore/main.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ti/wlcore/main.c 
b/drivers/net/wireless/ti/wlcore/main.c
index f140f7d7f553..8faee8cec1bc 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1746,9 +1746,7 @@ static int __maybe_unused wl1271_op_suspend(struct 
ieee80211_hw *hw,
 
ret = wl1271_configure_suspend(wl, wlvif, wow);
if (ret < 0) {
-   mutex_unlock(&wl->mutex);
-   wl1271_warning("couldn't prepare device to suspend");
-   return ret;
+   goto out_sleep;
}
}
 
-- 
2.17.1

[PATCH] wlcore: fix runtime pm imbalance in __wl1271_op_remove_interface

2020-05-20 Thread Dinghao Liu 
When wl12xx_cmd_role_disable() returns an error code,
a pairing runtime PM usage counter decrement is needed to
keep the counter balanced.

Signed-off-by: Dinghao Liu 
---
 drivers/net/wireless/ti/wlcore/main.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ti/wlcore/main.c 
b/drivers/net/wireless/ti/wlcore/main.c
index f140f7d7f553..e6c299efbc2e 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -2698,12 +2698,16 @@ static void __wl1271_op_remove_interface(struct wl1271 
*wl,
 
if (!wlcore_is_p2p_mgmt(wlvif)) {
ret = wl12xx_cmd_role_disable(wl, &wlvif->role_id);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(wl->dev);
goto deinit;
+   }
} else {
ret = wl12xx_cmd_role_disable(wl, &wlvif->dev_role_id);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(wl->dev);
goto deinit;
+   }
}
 
pm_runtime_mark_last_busy(wl->dev);
-- 
2.17.1

Re: Re: [PATCH] wlcore: fix runtime pm imbalance in wl1271_op_suspend

2020-05-20 Thread dinghao . liu 
There is a check against ret after out_sleep tag. If 
wl1271_configure_suspend_ap()
returns an error code, ret will be caught by this check and a warning will be 
issued.


"Tony Lindgren" <t...@atomide.com>写道：
> * Dinghao Liu  [200520 12:58]:
> > When wlcore_hw_interrupt_notify() returns an error code,
> > a pairing runtime PM usage counter decrement is needed to
> > keep the counter balanced.
> 
> We should probably keep the warning though, nothing will
> get shown for wl1271_configure_suspend_ap() errors.
> 
> Otherwise looks good to me.
> 
> Regards,
> 
> Tony

[PATCH] wlcore: fix runtime pm imbalance in wlcore_irq_locked

2020-05-21 Thread Dinghao Liu 
When wlcore_fw_status() returns an error code, a pairing
runtime PM usage counter decrement is needed to keep the
counter balanced. It's the same for all error paths after
wlcore_fw_status().

Signed-off-by: Dinghao Liu 
---
 drivers/net/wireless/ti/wlcore/main.c | 17 +
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/ti/wlcore/main.c 
b/drivers/net/wireless/ti/wlcore/main.c
index f140f7d7f553..fd3608223f64 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -548,7 +548,7 @@ static int wlcore_irq_locked(struct wl1271 *wl)
 
ret = wlcore_fw_status(wl, wl->fw_status);
if (ret < 0)
-   goto out;
+   goto err_ret;
 
wlcore_hw_tx_immediate_compl(wl);
 
@@ -565,7 +565,7 @@ static int wlcore_irq_locked(struct wl1271 *wl)
ret = -EIO;
 
/* restarting the chip. ignore any other interrupt. */
-   goto out;
+   goto err_ret;
}
 
if (unlikely(intr & WL1271_ACX_SW_INTR_WATCHDOG)) {
@@ -575,7 +575,7 @@ static int wlcore_irq_locked(struct wl1271 *wl)
ret = -EIO;
 
/* restarting the chip. ignore any other interrupt. */
-   goto out;
+   goto err_ret;
}
 
if (likely(intr & WL1271_ACX_INTR_DATA)) {
@@ -583,7 +583,7 @@ static int wlcore_irq_locked(struct wl1271 *wl)
 
ret = wlcore_rx(wl, wl->fw_status);
if (ret < 0)
-   goto out;
+   goto err_ret;
 
/* Check if any tx blocks were freed */
spin_lock_irqsave(&wl->wl_lock, flags);
@@ -596,7 +596,7 @@ static int wlcore_irq_locked(struct wl1271 *wl)
 */
ret = wlcore_tx_work_locked(wl);
if (ret < 0)
-   goto out;
+   goto err_ret;
} else {
spin_unlock_irqrestore(&wl->wl_lock, flags);
}
@@ -604,7 +604,7 @@ static int wlcore_irq_locked(struct wl1271 *wl)
/* check for tx results */
ret = wlcore_hw_tx_delayed_compl(wl);
if (ret < 0)
-   goto out;
+   goto err_ret;
 
/* Make sure the deferred queues don't get too long */
defer_count = skb_queue_len(&wl->deferred_tx_queue) +
@@ -617,14 +617,14 @@ static int wlcore_irq_locked(struct wl1271 *wl)
wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_A");
ret = wl1271_event_handle(wl, 0);
if (ret < 0)
-   goto out;
+   goto err_ret;
}
 
if (intr & WL1271_ACX_INTR_EVENT_B) {
wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_B");
ret = wl1271_event_handle(wl, 1);
if (ret < 0)
-   goto out;
+   goto err_ret;
}
 
if (intr & WL1271_ACX_INTR_INIT_COMPLETE)
@@ -635,6 +635,7 @@ static int wlcore_irq_locked(struct wl1271 *wl)
wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_HW_AVAILABLE");
}
 
+err_ret:
pm_runtime_mark_last_busy(wl->dev);
pm_runtime_put_autosuspend(wl->dev);
 
-- 
2.17.1

[PATCH] can: flexcan: Fix runtime PM imbalance on error

2020-05-22 Thread Dinghao Liu 
When register_flexcandev() returns an error code, a
pairing runtime PM usage counter decrement is needed
to keep the counter balanced.

Also, call pm_runtime_disable() when register_flexcandev()
returns an error code.

Signed-off-by: Dinghao Liu 
---
 drivers/net/can/flexcan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 94d10ec954a0..ea193426e5ae 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1666,6 +1666,8 @@ static int flexcan_probe(struct platform_device *pdev)
return 0;
 
  failed_register:
+   pm_runtime_put_noidle(&pdev->dev);
+   pm_runtime_disable(&pdev->dev);
free_candev(dev);
return err;
 }
-- 
2.17.1

[PATCH] net: smsc911x: Fix runtime PM imbalance on error

2020-05-23 Thread Dinghao Liu 
Remove runtime PM usage counter decrement when the
increment function has not been called to keep the
counter balanced.

Signed-off-by: Dinghao Liu 
---
 drivers/net/ethernet/smsc/smsc911x.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/smsc/smsc911x.c 
b/drivers/net/ethernet/smsc/smsc911x.c
index 49a6a9167af4..fc168f85e7af 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -2493,20 +2493,20 @@ static int smsc911x_drv_probe(struct platform_device 
*pdev)
 
retval = smsc911x_init(dev);
if (retval < 0)
-   goto out_disable_resources;
+   goto out_init_fail;
 
netif_carrier_off(dev);
 
retval = smsc911x_mii_init(pdev, dev);
if (retval) {
SMSC_WARN(pdata, probe, "Error %i initialising mii", retval);
-   goto out_disable_resources;
+   goto out_init_fail;
}
 
retval = register_netdev(dev);
if (retval) {
SMSC_WARN(pdata, probe, "Error %i registering device", retval);
-   goto out_disable_resources;
+   goto out_init_fail;
} else {
SMSC_TRACE(pdata, probe,
   "Network interface: \"%s\"", dev->name);
@@ -2547,9 +2547,10 @@ static int smsc911x_drv_probe(struct platform_device 
*pdev)
 
return 0;
 
-out_disable_resources:
+out_init_fail:
pm_runtime_put(&pdev->dev);
pm_runtime_disable(&pdev->dev);
+out_disable_resources:
(void)smsc911x_disable_resources(pdev);
 out_enable_resources_fail:
smsc911x_free_resources(pdev);
-- 
2.17.1