diff options
| author | Cole Leavitt <cole@unwrap.rs> | 2026-02-26 02:54:06 +0300 |
|---|---|---|
| committer | Kees Cook <kees@kernel.org> | 2026-04-01 00:52:26 +0300 |
| commit | 2ddb69f686ef7a621645e97fc7329c50edf5d0e5 (patch) | |
| tree | 7e019930834b7002bc8a71add719fbb95ade1dd7 | |
| parent | b22462c79179f228327b98313b47369129114d6a (diff) | |
| download | linux-2ddb69f686ef7a621645e97fc7329c50edf5d0e5.tar.xz | |
pstore/ram: fix resource leak when ioremap() fails
In persistent_ram_iomap(), ioremap() or ioremap_wc() may return NULL on
failure. Currently, if this happens, the function returns NULL without
releasing the memory region acquired by request_mem_region().
This leads to a resource leak where the memory region remains reserved
but unusable.
Additionally, the caller persistent_ram_buffer_map() handles NULL
correctly by returning -ENOMEM, but without this check, a NULL return
combined with request_mem_region() succeeding leaves resources in an
inconsistent state.
This is the ioremap() counterpart to commit 05363abc7625 ("pstore:
ram_core: fix incorrect success return when vmap() fails") which fixed
a similar issue in the vmap() path.
Fixes: 404a6043385d ("staging: android: persistent_ram: handle reserving and mapping memory")
Signed-off-by: Cole Leavitt <cole@unwrap.rs>
Link: https://patch.msgid.link/20260225235406.11790-1-cole@unwrap.rs
Signed-off-by: Kees Cook <kees@kernel.org>
| -rw-r--r-- | fs/pstore/ram_core.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index d47ba14e47bd..05048c6f787a 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -487,6 +487,10 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size, else va = ioremap_wc(start, size); + /* We must release the mem region if ioremap fails. */ + if (!va) + release_mem_region(start, size); + /* * Since request_mem_region() and ioremap() are byte-granularity * there is no need handle anything special like we do when the |