Re: [PATCH] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function

[Dan Carpenter]

On Tue, Dec 15, 2020 at 08:08:15PM +0100, Maxime Ripard wrote:
> On Tue, Dec 15, 2020 at 07:18:48PM +0100, Christophe JAILLET wrote:
> > Le 15/12/2020 à 12:37, Maxime Ripard a écrit :
> > > On Tue, Dec 15, 2020 at 12:11:53PM +0300, Dan Carpenter wrote:
> > > > On Tue, Dec 15, 2020 at 09:56:55AM +0100, Maxime Ripard wrote:
> > > > > Hi,
> > > > > 
> > > > > On Mon, Dec 14, 2020 at 09:21:17PM +0100, Christophe JAILLET wrote:
> > > > > > 'irq_of_parse_and_map()' should be balanced by a corresponding
> > > > > > 'irq_dispose_mapping()' call. Otherwise, there is some resources leaks.
> > > > > 
> > > > > Do you have a source to back that? It's not clear at all from the
> > > > > documentation for those functions, and couldn't find any user calling it
> > > > > from the ten-or-so random picks I took.
> > > > 
> > > > It looks like irq_create_of_mapping() needs to be freed with
> > > > irq_dispose_mapping() so this is correct.
> > > 
> > > The doc should be updated first to make that clear then, otherwise we're
> > > going to fix one user while multiples will have poped up
> > > 
> > > Maxime
> > > 
> > 
> > Hi,
> > 
> > as Dan explained, I think that 'irq_dispose_mapping()' is needed because of
> > the 'irq_create_of_mapping()" within 'irq_of_parse_and_map()'.
> > 
> > As you suggest, I'll propose a doc update to make it clear and more future
> > proof.
> 
> Thanks :)
> 
> And if you feel like it, a coccinelle script would be awesome too so
> that other users get fixed over time
> 
> Maxime

Smatch has a new check for resource leaks which hopefully people will
find useful.

https://github.com/error27/smatch/blob/master/check_unwind.c

To check for these I would need to add the following lines to the table:

        { "irq_of_parse_and_map", ALLOC, -1, "$", &int_one, &int_max},
        { "irq_create_of_mapping", ALLOC, -1, "$", &int_one, &int_max},
        { "irq_dispose_mapping", RELEASE, 0, "$"},

The '-1, "$"' means the returned value.  irq_of_parse_and_map() and
irq_create_of_mapping() return positive int on success.

The irq_dispose_mapping() frees its zeroth parameter so it's listed as
'0, "$"'.  We don't care about the returns from irq_dispose_mapping().

It doesn't apply in this case but if a function frees a struct member
then that's listed as '0, "$->member_name"'.

regards,
dan carpenter