Skip to content

Commit 891e0ea

Browse files
Yang Yingliangtakaswie
authored andcommitted
firewire: core: fix possible memory leak in create_units()
If device_register() fails, the refcount of device is not 0, the name allocated in dev_set_name() is leaked. To fix this by calling put_device(), so that it will be freed in callback function kobject_cleanup(). unreferenced object 0xffff9d99035c7a90 (size 8): comm "systemd-udevd", pid 168, jiffies 4294672386 (age 152.089s) hex dump (first 8 bytes): 66 77 30 2e 30 00 ff ff fw0.0... backtrace: [<00000000e1d62bac>] __kmem_cache_alloc_node+0x1e9/0x360 [<00000000bbeaff31>] __kmalloc_node_track_caller+0x44/0x1a0 [<00000000491f2fb4>] kvasprintf+0x67/0xd0 [<000000005b960ddc>] kobject_set_name_vargs+0x1e/0x90 [<00000000427ac591>] dev_set_name+0x4e/0x70 [<000000003b4e447d>] create_units+0xc5/0x110 fw_unit_release() will be called in the error path, move fw_device_get() before calling device_register() to keep balanced with fw_device_put() in fw_unit_release(). Cc: stable@vger.kernel.org Fixes: 1fa5ae8 ("driver core: get rid of struct device's bus_id string array") Fixes: a1f6481 ("firewire: struct device - replace bus_id with dev_name(), dev_set_name()") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
1 parent 2cc14f5 commit 891e0ea

File tree

1 file changed

+4
-7
lines changed

1 file changed

+4
-7
lines changed

drivers/firewire/core-device.c

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -717,14 +717,11 @@ static void create_units(struct fw_device *device)
717717
fw_unit_attributes,
718718
&unit->attribute_group);
719719

720-
if (device_register(&unit->device) < 0)
721-
goto skip_unit;
722-
723720
fw_device_get(device);
724-
continue;
725-
726-
skip_unit:
727-
kfree(unit);
721+
if (device_register(&unit->device) < 0) {
722+
put_device(&unit->device);
723+
continue;
724+
}
728725
}
729726
}
730727

0 commit comments

Comments
 (0)