tty: synclink_gt: release resources when synclink_gt driver open failed

  When synclink_gt driver open failed, it doesn't release resources. Compile
tested only.

Fixes: d4c63b7c7450 ("synclink_gt fix module reference")
Fixes: 705b6c7b34f2 ("[PATCH] new driver synclink_gt")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
---
 drivers/tty/synclink_gt.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)
  

On 14. 11. 22, 2:07, Zhengchao Shao wrote:
> When synclink_gt driver open failed, it doesn't release resources.

But hdlc_close() does. Now, you call it (apart from the TTY layer) too.

> Compile tested only.

Hmm, NACK.

> Fixes: d4c63b7c7450 ("synclink_gt fix module reference")
> Fixes: 705b6c7b34f2 ("[PATCH] new driver synclink_gt")
> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
> ---
>   drivers/tty/synclink_gt.c | 13 ++++++++++---
>   1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
> index 25e9befdda3a..4dea52486410 100644
> --- a/drivers/tty/synclink_gt.c
> +++ b/drivers/tty/synclink_gt.c
> @@ -1441,14 +1441,15 @@ static int hdlcdev_open(struct net_device *dev)
>   	/* generic HDLC layer open processing */
>   	rc = hdlc_open(dev);
>   	if (rc)
> -		return rc;
> +		goto err_open;
>   
>   	/* arbitrate between network and tty opens */
>   	spin_lock_irqsave(&info->netlock, flags);
>   	if (info->port.count != 0 || info->netcount != 0) {
>   		DBGINFO(("%s hdlc_open busy\n", dev->name));
>   		spin_unlock_irqrestore(&info->netlock, flags);
> -		return -EBUSY;
> +		rc = -EBUSY;
> +		goto err_open_busy;
>   	}
>   	info->netcount=1;
>   	spin_unlock_irqrestore(&info->netlock, flags);
> @@ -1458,7 +1459,7 @@ static int hdlcdev_open(struct net_device *dev)
>   		spin_lock_irqsave(&info->netlock, flags);
>   		info->netcount=0;
>   		spin_unlock_irqrestore(&info->netlock, flags);
> -		return rc;
> +		goto err_open_busy;
>   	}
>   
>   	/* assert RTS and DTR, apply hardware settings */
> @@ -1478,6 +1479,12 @@ static int hdlcdev_open(struct net_device *dev)
>   	else
>   		netif_carrier_off(dev);
>   	return 0;
> +
> +err_open_busy:
> +	hdlc_close(dev);
> +err_open:
> +	module_put(THIS_MODULE);
> +	return rc;
>   }
>   
>   /**
  

On Mon, Nov 14, 2022 at 09:07:34AM +0800, Zhengchao Shao wrote:
> When synclink_gt driver open failed, it doesn't release resources. Compile
> tested only.

How was this found?  Please always provide the proper required
information about stuff like this as our documentation requires.

thanks,

greg k-h
  

This patch identifies two problems in the error path of hdlcdev_open():

1. module_get/put pairing
2. hdlc_open/close pairing

The module_get/put calls are not necessary. The synclink_gt driver is pinned on hardware enumeration which happens before registering as a generic hdlc device. I think this is cruft leftover from ancient code. The only other generic hdlc (network) driver I still see doing it is farsync.c.

The best solution is removing the module_get/put calls and balancing hdlc_open() with hdlc_close() in the error path of hdlcdev_open(). I will submit a patch to do so after I’ve had a chance to test it.





> On Nov 13, 2022, at 5:07 PM, Zhengchao Shao <shaozhengchao@huawei.com> wrote:
> 
> When synclink_gt driver open failed, it doesn't release resources. Compile
> tested only.
> 
> Fixes: d4c63b7c7450 ("synclink_gt fix module reference")
> Fixes: 705b6c7b34f2 ("[PATCH] new driver synclink_gt")
> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
> ---
> drivers/tty/synclink_gt.c | 13 ++++++++++---
> 1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
> index 25e9befdda3a..4dea52486410 100644
> --- a/drivers/tty/synclink_gt.c
> +++ b/drivers/tty/synclink_gt.c
> @@ -1441,14 +1441,15 @@ static int hdlcdev_open(struct net_device *dev)
> 	/* generic HDLC layer open processing */
> 	rc = hdlc_open(dev);
> 	if (rc)
> -		return rc;
> +		goto err_open;
> 
> 	/* arbitrate between network and tty opens */
> 	spin_lock_irqsave(&info->netlock, flags);
> 	if (info->port.count != 0 || info->netcount != 0) {
> 		DBGINFO(("%s hdlc_open busy\n", dev->name));
> 		spin_unlock_irqrestore(&info->netlock, flags);
> -		return -EBUSY;
> +		rc = -EBUSY;
> +		goto err_open_busy;
> 	}
> 	info->netcount=1;
> 	spin_unlock_irqrestore(&info->netlock, flags);
> @@ -1458,7 +1459,7 @@ static int hdlcdev_open(struct net_device *dev)
> 		spin_lock_irqsave(&info->netlock, flags);
> 		info->netcount=0;
> 		spin_unlock_irqrestore(&info->netlock, flags);
> -		return rc;
> +		goto err_open_busy;
> 	}
> 
> 	/* assert RTS and DTR, apply hardware settings */
> @@ -1478,6 +1479,12 @@ static int hdlcdev_open(struct net_device *dev)
> 	else
> 		netif_carrier_off(dev);
> 	return 0;
> +
> +err_open_busy:
> +	hdlc_close(dev);
> +err_open:
> +	module_put(THIS_MODULE);
> +	return rc;
> }
> 
> /**
> -- 
> 2.17.1
>
  

On Tue, Nov 15, 2022 at 08:25:13AM -0800, Paul Fulghum wrote:
> Zhengchao Shao <shaozhengchao@huawei.com <mailto:shaozhengchao@huawei.com>> identified by inspection bugs in the error path of hdlcdev_open() in synclink_gt.c
> 
> The function did not fully unwind actions in the error path. The use of try_module_get()/module_put() is unnecessary, potentially hazardous and is removed. The synclink_gt driver is already pinned any point the net device is registered, a requirement for calling this entry point.
> 
> The call hdlc_open() to init the generic HDLC layer is moved to after driver level init/checks and proper rollback of previous actions is added. This is a more sensible ordering as the most common error paths are at the driver level and the driver level rollbacks require less processing than hdlc_open()/hdlc_close().
> 
> This has been tested with supported hardware.
> 
> Signed-off-by:Paul Fulghum <paulkf@microgate.com <mailto:paulkf@microgate.com>>
> 
> 
> diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
> index 25e9befdda3a..72b76cdde534 100644
> --- a/drivers/tty/synclink_gt.c
> +++ b/drivers/tty/synclink_gt.c
> @@ -1433,16 +1433,8 @@ static int hdlcdev_open(struct net_device *dev)
>  	int rc;
>  	unsigned long flags;
>  
> -	if (!try_module_get(THIS_MODULE))
> -		return -EBUSY;
> -
>  	DBGINFO(("%s hdlcdev_open\n", dev->name));
>  
> -	/* generic HDLC layer open processing */
> -	rc = hdlc_open(dev);
> -	if (rc)
> -		return rc;
> -
>  	/* arbitrate between network and tty opens */
>  	spin_lock_irqsave(&info->netlock, flags);
>  	if (info->port.count != 0 || info->netcount != 0) {
> @@ -1461,6 +1453,16 @@ static int hdlcdev_open(struct net_device *dev)
>  		return rc;
>  	}
>  
> +	/* generic HDLC layer open processing */
> +	rc = hdlc_open(dev);
> +	if (rc) {
> +		shutdown(info);
> +		spin_lock_irqsave(&info->netlock, flags);
> +		info->netcount = 0;
> +		spin_unlock_irqrestore(&info->netlock, flags);
> +		return rc;
> +	}
> +
>  	/* assert RTS and DTR, apply hardware settings */
>  	info->signals |= SerialSignal_RTS | SerialSignal_DTR;
>  	program_hw(info);
> @@ -1506,7 +1508,6 @@ static int hdlcdev_close(struct net_device *dev)
>  	info->netcount=0;
>  	spin_unlock_irqrestore(&info->netlock, flags);
>  
> -	module_put(THIS_MODULE);
>  	return 0;
>  }
>  
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- Your patch was sent in HTML format, making it impossible to be
  applied, and it has been rejected from the mailing lists because of
  that.  Please read the file, Documentation/email-clients.txt in order
  to fix this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot