Re: [PATCH] net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function

[Christophe JAILLET]

Le 15/12/2020 à 20:35, Dan Carpenter a écrit :
> On Tue, Dec 15, 2020 at 08:08:15PM +0100, Maxime Ripard wrote:
> > On Tue, Dec 15, 2020 at 07:18:48PM +0100, Christophe JAILLET wrote:
> > > Le 15/12/2020 à 12:37, Maxime Ripard a écrit :
> > > > On Tue, Dec 15, 2020 at 12:11:53PM +0300, Dan Carpenter wrote:
> > > > > On Tue, Dec 15, 2020 at 09:56:55AM +0100, Maxime Ripard wrote:
> > > > > > Hi,
> > > > > >
> > > > > > On Mon, Dec 14, 2020 at 09:21:17PM +0100, Christophe JAILLET wrote:
> > > > > > > 'irq_of_parse_and_map()' should be balanced by a corresponding
> > > > > > > 'irq_dispose_mapping()' call. Otherwise, there is some resources leaks.
> > > > > >
> > > > > > Do you have a source to back that? It's not clear at all from the
> > > > > > documentation for those functions, and couldn't find any user calling it
> > > > > > from the ten-or-so random picks I took.
> > > > >
> > > > > It looks like irq_create_of_mapping() needs to be freed with
> > > > > irq_dispose_mapping() so this is correct.
> > > >
> > > > The doc should be updated first to make that clear then, otherwise we're
> > > > going to fix one user while multiples will have poped up
> > > >
> > > > Maxime
> > >
> > > Hi,
> > >
> > > as Dan explained, I think that 'irq_dispose_mapping()' is needed because of
> > > the 'irq_create_of_mapping()" within 'irq_of_parse_and_map()'.
> > >
> > > As you suggest, I'll propose a doc update to make it clear and more future
> > > proof.
> >
> > Thanks :)
> >
> > And if you feel like it, a coccinelle script would be awesome too so
> > that other users get fixed over time
> >
> > Maxime
>
> Smatch has a new check for resource leaks which hopefully people will
> find useful.
>
> https://github.com/error27/smatch/blob/master/check_unwind.c

Nice :)
I wasn't aware of it.

> To check for these I would need to add the following lines to the table:
>
>          { "irq_of_parse_and_map", ALLOC, -1, "$", &int_one, &int_max},
>          { "irq_create_of_mapping", ALLOC, -1, "$", &int_one, &int_max},
>          { "irq_dispose_mapping", RELEASE, 0, "$"},
>
> The '-1, "$"' means the returned value.  irq_of_parse_and_map() and
> irq_create_of_mapping() return positive int on success.
>
> The irq_dispose_mapping() frees its zeroth parameter so it's listed as
> '0, "$"'.  We don't care about the returns from irq_dispose_mapping().
>
> It doesn't apply in this case but if a function frees a struct member
> then that's listed as '0, "$->member_name"'.
>
> regards,
> dan carpenter

The script I use to try to spot missing release function is:
///
@@
expression  x, y;
identifier f, l;
@@

*       x = irq_of_parse_and_map(...);
        ... when any
*       y = f(...);
        ... when any
*       if (<+... y ...+>)
        {
                ...
(
*               goto l;
|
*               return ...;
)
                ...
        }
        ... when any
*l:
        ... when != irq_dispose_mapping(...);
*       return ...;
///

It is likely that some improvement can be made, but it works pretty well 
for what I want.

And I have a collection of alloc/free functions that I manually put in 
place of irq_of_parse_and_map and irq_dispose_mapping.

Up to know, this list is:

// alloc_etherdev/alloc_etherdev_mq/alloc_etherdev_mqs - free_netdev
// alloc_workqueue - destroy_workqueue
// class_register - class_unregister
// clk_get - clk_put
// clk_prepare - clk_unprepare
// create_workqueue - destroy_workqueue
// create_singlethread_workqueue - destroy_workqueue
// 
dev_pm_domain_attach/dev_pm_domain_attach_by_id/dev_pm_domain_attach_by_name 
- dev_pm_domain_detach
// devres_alloc - devres_free
// dma_alloc_coherent - dma_free_coherent
// dma_map_resource - dma_unmap_resource
// dma_map_single - dma_unmap_single
// dma_request_slave_channel - dma_release_channel
// dma_request_chan - dma_release_channel
// framebuffer_alloc - framebuffer_release
// get_device - put_device
// iio_channel_get - iio_channel_release
// ioremap - iounmap
// input_allocate_device - input_free_device
// input_register_handle - input_unregister_handle
// irq_of_parse_and_map / irq_create_of_mapping - irq_dispose_mapping
// kmalloc - kfree
// mempool_alloc - mempool_free
// of_node_get - of_node_put
// of_reserved_mem_device_init - of_reserved_mem_device_release
// pinctrl_register - pinctrl_unregister
// request_irq - free_irq
// request_region - release_region
// request_mem_region - release_mem_region
// reset_control_assert - reset_control_deassert
// scsi_host_alloc - scsi_host_put

// pci_alloc_irq_vectors - pci_free_irq_vectors
// pci_dev_get - pci_dev_put
// pci_enable_device - pci_disable_device
// pci_iomap - pci_iounmap
// pci_request_region - pci_release_region
// pci_request_regions - pci_release_regions

// alloc_skb/__alloc_skb - kfree_skb/__kfree_skb
// dev_alloc_skb - dev_kfree_skb

// spi_dev_get - spi_dev_put
// spi_message_alloc - spi_message_free
// spi_register_master - spi_unregister_master