]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
perf/x86/intel/uncore: Fix iounmap() leak on global_init failure
authorZide Chen <zide.chen@intel.com>
Fri, 13 Mar 2026 17:40:47 +0000 (10:40 -0700)
committerPeter Zijlstra <peterz@infradead.org>
Tue, 7 Apr 2026 07:05:29 +0000 (09:05 +0200)
Kernel test robot reported:

Unverified Error/Warning (likely false positive, kindly check if
interested):
    arch/x86/events/intel/uncore_discovery.c:293:2-8:
    ERROR: missing iounmap; ioremap on line 288 and execution via
    conditional on line 292

If domain->global_init() fails in __parse_discovery_table(), the
ioremap'ed MMIO region is not released before returning, resulting
in an MMIO mapping leak.

Fixes: b575fc0e3357 ("perf/x86/intel/uncore: Add domain global init callback")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Zide Chen <zide.chen@intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Link: https://patch.msgid.link/20260313174050.171704-2-zide.chen@intel.com
arch/x86/events/intel/uncore_discovery.c

index 12e259a988dd17996a165f229b2a338bf75fef55..427939be2fb400639bb3281e97848f65ffed6054 100644 (file)
@@ -264,6 +264,7 @@ static int __parse_discovery_table(struct uncore_discovery_domain *domain,
        struct uncore_unit_discovery unit;
        void __iomem *io_addr;
        unsigned long size;
+       int ret = 0;
        int i;
 
        size = UNCORE_DISCOVERY_GLOBAL_MAP_SIZE;
@@ -273,21 +274,23 @@ static int __parse_discovery_table(struct uncore_discovery_domain *domain,
 
        /* Read Global Discovery State */
        memcpy_fromio(&global, io_addr, sizeof(struct uncore_global_discovery));
+       iounmap(io_addr);
+
        if (uncore_discovery_invalid_unit(global)) {
                pr_info("Invalid Global Discovery State: 0x%llx 0x%llx 0x%llx\n",
                        global.table1, global.ctl, global.table3);
-               iounmap(io_addr);
                return -EINVAL;
        }
-       iounmap(io_addr);
 
        size = (1 + global.max_units) * global.stride * 8;
        io_addr = ioremap(addr, size);
        if (!io_addr)
                return -ENOMEM;
 
-       if (domain->global_init && domain->global_init(global.ctl))
-               return -ENODEV;
+       if (domain->global_init && domain->global_init(global.ctl)) {
+               ret = -ENODEV;
+               goto out;
+       }
 
        /* Parsing Unit Discovery State */
        for (i = 0; i < global.max_units; i++) {
@@ -307,8 +310,10 @@ static int __parse_discovery_table(struct uncore_discovery_domain *domain,
        }
 
        *parsed = true;
+
+out:
        iounmap(io_addr);
-       return 0;
+       return ret;
 }
 
 static int parse_discovery_table(struct uncore_discovery_domain *domain,