| Message ID | 20230622090233.188539-1-harperchen1110@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | mmc: sunplus: fix return value check of mmc_add_host() | expand |
On Thu, 22 Jun 2023 at 11:02, Wei Chen <harperchen1110@gmail.com> wrote: > > mmc_add_host() may return error, if we ignore its return value, > 1. the memory allocated in mmc_alloc_host() will be leaked > 2. null-ptr-deref will happen when calling mmc_remove_host() > in remove function spmmc_drv_remove() because deleting not > added device. > > Fix this by checking the return value of mmc_add_host(). Moreover, > I fixed the error handling path of spmmc_drv_probe() to clean up. > > Signed-off-by: Wei Chen <harperchen1110@gmail.com> Applied for next, thanks! Kind regards Uffe > --- > drivers/mmc/host/sunplus-mmc.c | 16 ++++++++++++---- > 1 file changed, 12 insertions(+), 4 deletions(-) > > diff --git a/drivers/mmc/host/sunplus-mmc.c b/drivers/mmc/host/sunplus-mmc.c > index db5e0dcdfa7f..a96e90ea6541 100644 > --- a/drivers/mmc/host/sunplus-mmc.c > +++ b/drivers/mmc/host/sunplus-mmc.c > @@ -902,7 +902,7 @@ static int spmmc_drv_probe(struct platform_device *pdev) > > ret = mmc_of_parse(mmc); > if (ret) > - goto probe_free_host; > + goto clk_disable; > > mmc->ops = &spmmc_ops; > mmc->f_min = SPMMC_MIN_CLK; > @@ -911,7 +911,7 @@ static int spmmc_drv_probe(struct platform_device *pdev) > > ret = mmc_regulator_get_supply(mmc); > if (ret) > - goto probe_free_host; > + goto clk_disable; > > if (!mmc->ocr_avail) > mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34; > @@ -927,9 +927,17 @@ static int spmmc_drv_probe(struct platform_device *pdev) > host->tuning_info.enable_tuning = 1; > pm_runtime_set_active(&pdev->dev); > pm_runtime_enable(&pdev->dev); > - mmc_add_host(mmc); > + ret = mmc_add_host(mmc); > + if (ret) > + goto pm_disable; > > - return ret; > + return 0; > + > +pm_disable: > + pm_runtime_disable(&pdev->dev); > + > +clk_disable: > + clk_disable_unprepare(host->clk); > > probe_free_host: > if (mmc) > -- > 2.25.1 >
diff --git a/drivers/mmc/host/sunplus-mmc.c b/drivers/mmc/host/sunplus-mmc.c index db5e0dcdfa7f..a96e90ea6541 100644 --- a/drivers/mmc/host/sunplus-mmc.c +++ b/drivers/mmc/host/sunplus-mmc.c @@ -902,7 +902,7 @@ static int spmmc_drv_probe(struct platform_device *pdev) ret = mmc_of_parse(mmc); if (ret) - goto probe_free_host; + goto clk_disable; mmc->ops = &spmmc_ops; mmc->f_min = SPMMC_MIN_CLK; @@ -911,7 +911,7 @@ static int spmmc_drv_probe(struct platform_device *pdev) ret = mmc_regulator_get_supply(mmc); if (ret) - goto probe_free_host; + goto clk_disable; if (!mmc->ocr_avail) mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34; @@ -927,9 +927,17 @@ static int spmmc_drv_probe(struct platform_device *pdev) host->tuning_info.enable_tuning = 1; pm_runtime_set_active(&pdev->dev); pm_runtime_enable(&pdev->dev); - mmc_add_host(mmc); + ret = mmc_add_host(mmc); + if (ret) + goto pm_disable; - return ret; + return 0; + +pm_disable: + pm_runtime_disable(&pdev->dev); + +clk_disable: + clk_disable_unprepare(host->clk); probe_free_host: if (mmc)
mmc_add_host() may return error, if we ignore its return value, 1. the memory allocated in mmc_alloc_host() will be leaked 2. null-ptr-deref will happen when calling mmc_remove_host() in remove function spmmc_drv_remove() because deleting not added device. Fix this by checking the return value of mmc_add_host(). Moreover, I fixed the error handling path of spmmc_drv_probe() to clean up. Signed-off-by: Wei Chen <harperchen1110@gmail.com> --- drivers/mmc/host/sunplus-mmc.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)