[PATCH v2] staging: vme_user: fix flush_image leak in tsi148 bridge

[PATCH v2] staging: vme_user: fix flush_image leak in tsi148 bridge

[Cong Nguyen]

When error checking is enabled (err_chk=1), tsi148_probe() allocates an
extra master window resource, tsi148_device->flush_image, which is used
to flush posted writes by reading back over the VME bus. Unlike the
regular master windows, this resource is not linked into
tsi148_bridge->master_resources.

Because it is not on any resource list, it is freed neither by the probe
error path (which only walks the master_resources list) nor by
tsi148_remove(), so it is leaked whenever err_chk is set and either
probe fails after the allocation or the device is unbound / the module
is unloaded.

Free flush_image in both the probe error path and tsi148_remove(). This
is safe when err_chk is disabled: tsi148_device is allocated with
kzalloc() so flush_image is NULL and kfree(NULL) is a no-op.

Fixes: d22b8ed9a3b0 ("Staging: vme: add Tundra TSI148 VME-PCI Bridge driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
---
Changes in v2:
- Add Assisted-by: tag (Greg Kroah-Hartman). No code changes.

 drivers/staging/vme_user/vme_tsi148.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/vme_user/vme_tsi148.c b/drivers/staging/vme_user/vme_tsi148.c
index c695ad9b4ca2..8ee1e00cef4f 100644
--- a/drivers/staging/vme_user/vme_tsi148.c
+++ b/drivers/staging/vme_user/vme_tsi148.c
@@ -2513,6 +2513,7 @@ static int tsi148_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		list_del(pos);
 		kfree(master_image);
 	}
+	kfree(tsi148_device->flush_image);
 
 	tsi148_irq_exit(tsi148_bridge, pdev);
 err_irq:
@@ -2619,6 +2620,8 @@ static void tsi148_remove(struct pci_dev *pdev)
 		kfree(master_image);
 	}
 
+	kfree(bridge->flush_image);
+
 	iounmap(bridge->base);
 
 	pci_release_regions(pdev);
-- 
2.25.1

Re: [PATCH v2] staging: vme_user: fix flush_image leak in tsi148 bridge

[Greg Kroah-Hartman]

On Thu, Aug 13, 2026 at 07:10:57PM +0700, Cong Nguyen wrote:
> When error checking is enabled (err_chk=1), tsi148_probe() allocates an
> extra master window resource, tsi148_device->flush_image, which is used
> to flush posted writes by reading back over the VME bus. Unlike the
> regular master windows, this resource is not linked into
> tsi148_bridge->master_resources.
> 
> Because it is not on any resource list, it is freed neither by the probe
> error path (which only walks the master_resources list) nor by
> tsi148_remove(), so it is leaked whenever err_chk is set and either
> probe fails after the allocation or the device is unbound / the module
> is unloaded.
> 
> Free flush_image in both the probe error path and tsi148_remove(). This
> is safe when err_chk is disabled: tsi148_device is allocated with
> kzalloc() so flush_image is NULL and kfree(NULL) is a no-op.
> 
> Fixes: d22b8ed9a3b0 ("Staging: vme: add Tundra TSI148 VME-PCI Bridge driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4
> Signed-off-by: Cong Nguyen <congnt264@gmail.com>
> ---
> Changes in v2:
> - Add Assisted-by: tag (Greg Kroah-Hartman). No code changes.

You have read this:
	https://lore.kernel.org/all/2026080354-skater-urgent-31b2@gregkh/T/#u
right?

If not, please do so.

thanks,

greg k-h

Re: [PATCH v2] staging: vme_user: fix flush_image leak in tsi148 bridge

[Nguyễn Công]

On Thu, Aug 13, 2026 at 7:26 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Thu, Aug 13, 2026 at 07:10:57PM +0700, Cong Nguyen wrote:
> > When error checking is enabled (err_chk=1), tsi148_probe() allocates an
> > extra master window resource, tsi148_device->flush_image, which is used
> > to flush posted writes by reading back over the VME bus. Unlike the
> > regular master windows, this resource is not linked into
> > tsi148_bridge->master_resources.
> >
> > Because it is not on any resource list, it is freed neither by the probe
> > error path (which only walks the master_resources list) nor by
> > tsi148_remove(), so it is leaked whenever err_chk is set and either
> > probe fails after the allocation or the device is unbound / the module
> > is unloaded.
> >
> > Free flush_image in both the probe error path and tsi148_remove(). This
> > is safe when err_chk is disabled: tsi148_device is allocated with
> > kzalloc() so flush_image is NULL and kfree(NULL) is a no-op.
> >
> > Fixes: d22b8ed9a3b0 ("Staging: vme: add Tundra TSI148 VME-PCI Bridge driver")
> > Cc: stable@vger.kernel.org
> > Assisted-by: Claude:claude-opus-4
> > Signed-off-by: Cong Nguyen <congnt264@gmail.com>
> > ---
> > Changes in v2:
> > - Add Assisted-by: tag (Greg Kroah-Hartman). No code changes.
>
> You have read this:
>         https://lore.kernel.org/all/2026080354-skater-urgent-31b2@gregkh/T/#u
> right?
>
> If not, please do so.
>
> thanks,
>
> greg k-h

I have now, thanks. I don't have TSI148 hardware to test on, so this
change doesn't meet the bar you describe for LLM-assisted staging
patches. Please drop it.

I'll hold off on further drivers/staging/ submissions unless I can test
them on the actual hardware. Sorry for the noise, and thanks for the
clear guidance.

Cong