Re: [PATCH] net: ipa: Fix valid_state leak in ipa_smp2p_init()

[Alex Elder]

On 9/17/26 6:54 AM, Wentao Liang wrote:
> qcom_smem_state_get() takes a reference on the state, but
> ipa_smp2p_init() returns without releasing the "ipa-clock-enabled-valid"
> state when the bit number is out of range, when the "ipa-clock-enabled"
> state cannot be acquired or its bit number is out of range, when the
> smp2p structure cannot be allocated, and on the error paths that free
> the structure. Release the reference on all of these paths.

I haven't looked very closely at this one but it also seems
to have been fixed already.

  96ca1e658ae45 net: ipa: fix SMEM state handle leaks in SMP2P init

					-Alex

> Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>   drivers/net/ipa/ipa_smp2p.c | 11 +++++++++--
>   1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
> index 78f6df2cad76..f45225b16722 100644
> --- a/drivers/net/ipa/ipa_smp2p.c
> +++ b/drivers/net/ipa/ipa_smp2p.c
> @@ -232,21 +232,27 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
>   					  &valid_bit);
>   	if (IS_ERR(valid_state))
>   		return PTR_ERR(valid_state);
> -	if (valid_bit >= 32)		/* BITS_PER_U32 */
> +	if (valid_bit >= 32) {		/* BITS_PER_U32 */
> +		qcom_smem_state_put(valid_state);
>   		return -EINVAL;
> +	}
>   
>   	enabled_state = qcom_smem_state_get(dev, "ipa-clock-enabled",
>   					    &enabled_bit);
> -	if (IS_ERR(enabled_state))
> +	if (IS_ERR(enabled_state)) {
> +		qcom_smem_state_put(valid_state);
>   		return PTR_ERR(enabled_state);
> +	}
>   	if (enabled_bit >= 32) {	/* BITS_PER_U32 */
>   		qcom_smem_state_put(enabled_state);
> +		qcom_smem_state_put(valid_state);
>   		return -EINVAL;
>   	}
>   
>   	smp2p = kzalloc_obj(*smp2p);
>   	if (!smp2p) {
>   		qcom_smem_state_put(enabled_state);
> +		qcom_smem_state_put(valid_state);
>   		return -ENOMEM;
>   	}
>   
> @@ -293,6 +299,7 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
>   	ipa->smp2p = NULL;
>   	mutex_destroy(&smp2p->mutex);
>   	qcom_smem_state_put(enabled_state);
> +	qcom_smem_state_put(valid_state);
>   	kfree(smp2p);
>   
>   	return ret;