Re: [PATCH] component: Release match data on add failure

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] `component_master_add_with_match()` blindly dereferences the `match` parameter without checking if it is an `ERR_PTR`, leading to a kernel panic.
--

--- Patch [1]: [PATCH] component: Release match data on add failure ---
commit c4097bf086b1fb54cc12acc0308e520336458718
Author: Ruoyu Wang <[email protected]>

component: Release match data on add failure

component_match_add_release() accepts a release callback so callers can
transfer ownership of resources held by the match data. However,
__component_match_add() returns without invoking that callback when the
match is already an error pointer or when allocating the match or its
array fails.

> diff --git a/drivers/base/component.c b/drivers/base/component.c
> index 655d68deb590c..2b455d7499926 100644
> --- a/drivers/base/component.c
> +++ b/drivers/base/component.c
> @@ -388,14 +388,14 @@ static void __component_match_add(struct device *parent,
>  	struct component_match *match = *matchptr;
>  
>  	if (IS_ERR(match))
> -		return;
> +		goto err_release;
>  
>  	if (!match) {
>  		match = devres_alloc(devm_component_match_release,
>  				     sizeof(*match), GFP_KERNEL);
>  		if (!match) {
>  			*matchptr = ERR_PTR(-ENOMEM);
> -			return;
> +			goto err_release;

[Severity: High]
This is a pre-existing issue, but if __component_match_add() fails here and
sets *matchptr to ERR_PTR(-ENOMEM), could this result in a kernel panic
later?

Callers such as drm_of_component_probe() in drivers/gpu/drm/drm_of.c often
pass the resulting match pointer directly to
component_master_add_with_match() without checking IS_ERR(match):

drivers/gpu/drm/drm_of.c:drm_of_component_probe() {
    ...
    return component_master_add_with_match(dev, m_ops, match);
}

component_master_add_with_match() then appears to blindly dereference the
pointer:

drivers/base/component.c:component_master_add_with_match() {
    ...
    ret = component_match_realloc(match, match->num);
    ...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1