github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ptp: ocp: fix dpll cleanup on probe error

Browse Source 
Two problems on the dpll error paths in ptp_ocp_probe().

dpll_device_register() takes a second reference and stores bp as the
registration private data, and only dpll_device_unregister() drops it.
out_dpll dropped bp->tracker but never unregistered, so a dpll_pin_get()
or dpll_pin_register() failure left the device registered and visible to
userspace with a priv pointer into the storage devlink_free() releases a
few lines later, as well as leaking the registration object.

A failing dpll_device_register() jumped to the same label as the failing
dpll_device_get(), so the reference taken by dpll_device_get() was never
dropped either.  Give that case its own label.

Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path
Signed-off-by: Sagi Maimon <maimon.sagi@gmail.com>
Link: https://patch.msgid.link/20260916153242.157171-3-sagi.maimon@adtran.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Sagi Maimon 2026-09-16 18:32:40 +03:00 committed by Jakub Kicinski
parent a2bd6c1766
commit 65ca1f70c4
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/ptp/ptp_ocp.c
View File

@ -5124,7 +5124,7 @@ ptp_ocp_probe(struct pci_dev *pdev, const struct pci_device_id *id)
err = dpll_device_register(bp->dpll, DPLL_TYPE_PPS, &dpll_ops, bp);
if (err)
goto out_devlink;
goto out_dpll_put;
for (i = 0; i < OCP_SMA_NUM; i++) {
bp->sma[i].dpll_pin = dpll_pin_get(clkid, i, THIS_MODULE,
@ -5150,6 +5150,12 @@ ptp_ocp_probe(struct pci_dev *pdev, const struct pci_device_id *id)
dpll_pin_unregister(bp->dpll, bp->sma[i].dpll_pin, &dpll_pins_ops, &bp->sma[i]);
dpll_pin_put(bp->sma[i].dpll_pin, &bp->sma[i].tracker);
}
/* dpll_device_register() takes a second reference and stores bp; only
* dpll_device_unregister() drops it. Without this the device stays
* visible with a priv pointer into storage devlink_free() will release.
*/
dpll_device_unregister(bp->dpll, &dpll_ops, bp);
out_dpll_put:
dpll_device_put(bp->dpll, &bp->tracker);
out_devlink:
devlink_unregister(devlink);