diff options
| author | Shang XiaoJing <shangxiaojing@huawei.com> | 2022-11-02 15:26:59 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-11-10 18:38:33 +0100 |
| commit | 4634c973096a64662a24d9914c47cebc2a8b72f4 (patch) | |
| tree | b4a2923cc50b1642a55b0b31fe3cb224b62c3c27 /fs/char_dev.c | |
| parent | 231601cd22bd60e332dfa9ead22f871e93ad9821 (diff) | |
chardev: Fix potential memory leak when cdev_add() failed
Some init function of cdev(like comedi) will call kobject_set_name()
before cdev_add(), but won't free the cdev.kobj.name or put the ref cnt
of cdev.kobj when cdev_add() failed. As the result, cdev.kobj.name will
be leaked.
Free the name of kobject in cdev_add() fail path to prevent memleak. With
this fix, the callers don't need to care about freeing the name of
kobject if cdev_add() fails.
unreferenced object 0xffff8881000fa8c0 (size 8):
comm "modprobe", pid 239, jiffies 4294905173 (age 51.308s)
hex dump (first 8 bytes):
63 6f 6d 65 64 69 00 ff comedi..
backtrace:
[<000000005f9878f7>] __kmalloc_node_track_caller+0x4c/0x1c0
[<000000000fd70302>] kstrdup+0x3f/0x70
[<000000009428bc33>] kstrdup_const+0x46/0x60
[<00000000ed50d9de>] kvasprintf_const+0xdb/0xf0
[<00000000b2766964>] kobject_set_name_vargs+0x3c/0xe0
[<00000000f2424ef7>] kobject_set_name+0x62/0x90
[<000000005d5a125b>] 0xffffffffa0013098
[<00000000f331e663>] do_one_initcall+0x7a/0x380
[<00000000aa7bac96>] do_init_module+0x5c/0x230
[<000000005fd72335>] load_module+0x227d/0x2420
[<00000000ad550cf1>] __do_sys_finit_module+0xd5/0x140
[<00000000069a60c5>] do_syscall_64+0x3f/0x90
[<00000000c5e0d521>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Suggested-by: Greg KH <gregkh@linuxfoundation.org>
Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
Link: https://lore.kernel.org/r/20221102072659.23671-1-shangxiaojing@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/char_dev.c')
| -rw-r--r-- | fs/char_dev.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/fs/char_dev.c b/fs/char_dev.c index ba0ded7842a7..340e4543b24a 100644 --- a/fs/char_dev.c +++ b/fs/char_dev.c @@ -483,17 +483,24 @@ int cdev_add(struct cdev *p, dev_t dev, unsigned count) p->dev = dev; p->count = count; - if (WARN_ON(dev == WHITEOUT_DEV)) - return -EBUSY; + if (WARN_ON(dev == WHITEOUT_DEV)) { + error = -EBUSY; + goto err; + } error = kobj_map(cdev_map, dev, count, NULL, exact_match, exact_lock, p); if (error) - return error; + goto err; kobject_get(p->kobj.parent); return 0; + +err: + kfree_const(p->kobj.name); + p->kobj.name = NULL; + return error; } /** |