[PATCH] usb: gadget: udc: add return value check of kzalloc in mv_udc_probe

[PATCH] usb: gadget: udc: add return value check of kzalloc in mv_udc_probe

[void0red]

Even an 8-byte kzalloc will fail when we don't have enough memory,
so we need a nullptr check and do the cleanup when it fails.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=217081

Signed-off-by: void0red <void0red@gmail.com>
---
 drivers/usb/gadget/udc/mv_udc_core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
index b397f3a84..6dd6d52de 100644
--- a/drivers/usb/gadget/udc/mv_udc_core.c
+++ b/drivers/usb/gadget/udc/mv_udc_core.c
@@ -2230,6 +2230,10 @@ static int mv_udc_probe(struct platform_device *pdev)
 
 	/* allocate a small amount of memory to get valid address */
 	udc->status_req->req.buf = kzalloc(8, GFP_KERNEL);
+	if (!udc->status_req->req.buf) {
+		retval = -ENOMEM;
+		goto err_destroy_dma;
+	}
 	udc->status_req->req.dma = DMA_ADDR_INVALID;
 
 	udc->resume_state = USB_STATE_NOTATTACHED;
-- 
2.34.1

Re: [PATCH] usb: gadget: udc: add return value check of kzalloc in mv_udc_probe

[Greg KH]

On Fri, Feb 24, 2023 at 04:08:42PM +0800, void0red wrote:
> Even an 8-byte kzalloc will fail when we don't have enough memory,
> so we need a nullptr check and do the cleanup when it fails.
> 
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=217081
> 
> Signed-off-by: void0red <void0red@gmail.com>
> ---
>  drivers/usb/gadget/udc/mv_udc_core.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
> index b397f3a84..6dd6d52de 100644
> --- a/drivers/usb/gadget/udc/mv_udc_core.c
> +++ b/drivers/usb/gadget/udc/mv_udc_core.c
> @@ -2230,6 +2230,10 @@ static int mv_udc_probe(struct platform_device *pdev)
>  
>  	/* allocate a small amount of memory to get valid address */
>  	udc->status_req->req.buf = kzalloc(8, GFP_KERNEL);
> +	if (!udc->status_req->req.buf) {
> +		retval = -ENOMEM;
> +		goto err_destroy_dma;
> +	}
>  	udc->status_req->req.dma = DMA_ADDR_INVALID;
>  
>  	udc->resume_state = USB_STATE_NOTATTACHED;
> -- 
> 2.34.1
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- It looks like you did not use your "real" name for the patch on either
  the Signed-off-by: line, or the From: line (both of which have to
  match).  Please read the kernel file,
  Documentation/process/submitting-patches.rst for how to do this
  correctly.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot

[PATCH] usb: gadget: udc: add return value check of kzalloc in mv_udc_probe

[void0red]

From: Kang Chen <void0red@gmail.com>

Even an 8-byte kzalloc will fail when we don't have enough memory,
so we need a nullptr check and do the cleanup when it fails.

Reported-by: eriri <1527030098@qq.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217081

Signed-off-by: Kang Chen <void0red@gmail.com>
---
 drivers/usb/gadget/udc/mv_udc_core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
index b397f3a84..6dd6d52de 100644
--- a/drivers/usb/gadget/udc/mv_udc_core.c
+++ b/drivers/usb/gadget/udc/mv_udc_core.c
@@ -2230,6 +2230,10 @@ static int mv_udc_probe(struct platform_device *pdev)
 
 	/* allocate a small amount of memory to get valid address */
 	udc->status_req->req.buf = kzalloc(8, GFP_KERNEL);
+	if (!udc->status_req->req.buf) {
+		retval = -ENOMEM;
+		goto err_destroy_dma;
+	}
 	udc->status_req->req.dma = DMA_ADDR_INVALID;
 
 	udc->resume_state = USB_STATE_NOTATTACHED;
-- 
2.34.1

Re: [PATCH] usb: gadget: udc: add return value check of kzalloc in mv_udc_probe

[Dongliang Mu]

On Fri, Feb 24, 2023 at 5:28 PM void0red <void0red@gmail.com> wrote:
>
> From: Kang Chen <void0red@gmail.com>
>
> Even an 8-byte kzalloc will fail when we don't have enough memory,
> so we need a nullptr check and do the cleanup when it fails.
>
> Reported-by: eriri <1527030098@qq.com>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=217081
>
> Signed-off-by: Kang Chen <void0red@gmail.com>
> ---
>  drivers/usb/gadget/udc/mv_udc_core.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
> index b397f3a84..6dd6d52de 100644
> --- a/drivers/usb/gadget/udc/mv_udc_core.c
> +++ b/drivers/usb/gadget/udc/mv_udc_core.c
> @@ -2230,6 +2230,10 @@ static int mv_udc_probe(struct platform_device *pdev)
>
>         /* allocate a small amount of memory to get valid address */
>         udc->status_req->req.buf = kzalloc(8, GFP_KERNEL);

Hi Kang and gregkh,

I think there is a memory leak in this kzalloc. It seems there is no
deallocation for this allocated object.

As the surrounding allocation statements suggest,
we should turn kzalloc to devm_kzalloc.

> +       if (!udc->status_req->req.buf) {
> +               retval = -ENOMEM;
> +               goto err_destroy_dma;
> +       }
>         udc->status_req->req.dma = DMA_ADDR_INVALID;
>
>         udc->resume_state = USB_STATE_NOTATTACHED;
> --
> 2.34.1
>

Re: [PATCH] usb: gadget: udc: add return value check of kzalloc in mv_udc_probe

[Kang Chen]

Hi, Dongliang,

I totally agree with you. I checked the other drivers using
status_req->req.buf structure, they free the memory when
the driver removed. But in this driver, I can't find such code. So,
as you said, it needs a devm_kazlloc instead of a kzalloc to manage
the memory and avoid a memory leak.

Thanks for your correction. I will post a new patch later.

Dongliang Mu <mudongliangabcd@gmail.com> 于2023年2月24日周五 19:06写道：

>
> On Fri, Feb 24, 2023 at 5:28 PM void0red <void0red@gmail.com> wrote:
> >
> > From: Kang Chen <void0red@gmail.com>
> >
> > Even an 8-byte kzalloc will fail when we don't have enough memory,
> > so we need a nullptr check and do the cleanup when it fails.
> >
> > Reported-by: eriri <1527030098@qq.com>
> > Link: https://bugzilla.kernel.org/show_bug.cgi?id=217081
> >
> > Signed-off-by: Kang Chen <void0red@gmail.com>
> > ---
> >  drivers/usb/gadget/udc/mv_udc_core.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
> > index b397f3a84..6dd6d52de 100644
> > --- a/drivers/usb/gadget/udc/mv_udc_core.c
> > +++ b/drivers/usb/gadget/udc/mv_udc_core.c
> > @@ -2230,6 +2230,10 @@ static int mv_udc_probe(struct platform_device *pdev)
> >
> >         /* allocate a small amount of memory to get valid address */
> >         udc->status_req->req.buf = kzalloc(8, GFP_KERNEL);
>
> Hi Kang and gregkh,
>
> I think there is a memory leak in this kzalloc. It seems there is no
> deallocation for this allocated object.
>
> As the surrounding allocation statements suggest,
> we should turn kzalloc to devm_kzalloc.
>
> > +       if (!udc->status_req->req.buf) {
> > +               retval = -ENOMEM;
> > +               goto err_destroy_dma;
> > +       }
> >         udc->status_req->req.dma = DMA_ADDR_INVALID;
> >
> >         udc->resume_state = USB_STATE_NOTATTACHED;
> > --
> > 2.34.1
> >