From patchwork Mon Oct 17 03:13:35 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yang Yingliang X-Patchwork-Id: 3196 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp1247824wrs; Sun, 16 Oct 2022 20:16:59 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6B1xH2mZDycZdWOdf6j5RxV0HTnQ8JTstpYmkycXGaFUPRm0OkhMtwK3VTYETCCcTAf0H4 X-Received: by 2002:a17:907:3e0f:b0:791:9529:3674 with SMTP id hp15-20020a1709073e0f00b0079195293674mr549460ejc.503.1665976619620; Sun, 16 Oct 2022 20:16:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665976619; cv=none; d=google.com; s=arc-20160816; b=oY08PV1BL/RxZhnqVdEFkGQHKz0d8L7PWHkQ5dSNqLY2GCZvF1SW5yOFgc9Y0j/t+l BgyjmkkMb1ubk7qzmvU+kol7jZ5GelFfXy47YyxGQsaY5Jq10SkYa9kGgZUsfcu+0zLP VfLk/f+6DDtmFzYD3Ynvp2rnL/mRVSpuYVlNVr+T6NGzWBqUXg3kKkLQ2RLkOnuAUzYn WCkNnMd5FAk6Ta+ixNmxNsACA0tDJbRdvHv21x5C6VgyW5hO9kanxlYMCp2htMA8POfz GqadkkRHGcBNSmEFgwK0S9NPjwwCPnoJU6MGMJJmTB3IQyHBfLNcZlCxAyUyWgUezRfg Z4jg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=tgJmKY9g8IkSvAArjAXdqSzP/H5Vl04wLIPGhz06VSU=; b=izIF3yuLToDpdmWrC1uhKFd6QhP/UEemrXcrAioU/5/ZTK//Sm+PGoP38/1QblPCc1 u1rLsxZM6meRvD7CFoUdUlv4mKLANxZPd4pTd4WgspQXaaCRt2+a8S5bGG4oLXgsAarm A9qhi2Ujsc1+N/mEZENJIwSMdXInhbLBRXaCshPnaCuudfsopuUHN3Fi436g0bLfb7Bn A9xeAKGD041PWKESDHxB5CLqXL+9xfyxlMmAmcRuY1yoNmFzyJBcTS04s6WnE4JXFttW y3O0baeDM730qbQ6yc21j6iNqQqvDo1LFTwY6Kf752PMFLvsQ6U1jpolHmkv+Hc3/o8+ OyRw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id q14-20020a056402248e00b00456d901922bsi8137842eda.510.2022.10.16.20.16.34; Sun, 16 Oct 2022 20:16:59 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231994AbiJQDOp (ORCPT + 99 others); Sun, 16 Oct 2022 23:14:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41656 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231987AbiJQDOk (ORCPT ); Sun, 16 Oct 2022 23:14:40 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 49765BC8F for ; Sun, 16 Oct 2022 20:14:38 -0700 (PDT) Received: from dggpemm500021.china.huawei.com (unknown [172.30.72.57]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4MrMRv133kzVjTp; Mon, 17 Oct 2022 11:10:03 +0800 (CST) Received: from dggpemm500007.china.huawei.com (7.185.36.183) by dggpemm500021.china.huawei.com (7.185.36.109) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Mon, 17 Oct 2022 11:14:15 +0800 Received: from huawei.com (10.175.103.91) by dggpemm500007.china.huawei.com (7.185.36.183) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Mon, 17 Oct 2022 11:14:15 +0800 From: Yang Yingliang To: CC: , Subject: [PATCH] class: fix possible memory leak in __class_register() Date: Mon, 17 Oct 2022 11:13:35 +0800 Message-ID: <20221017031335.1845383-1-yangyingliang@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.175.103.91] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To dggpemm500007.china.huawei.com (7.185.36.183) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746903100090959115?= X-GMAIL-MSGID: =?utf-8?q?1746903100090959115?= If kset_register() fails, the refcount of kobject is not 0, the name allocated in kobject_set_name() is leaked. To fix this by calling kfree_const(). unreferenced object 0xffff888102fa8190 (size 8): comm "modprobe", pid 502, jiffies 4294906074 (age 49.296s) hex dump (first 8 bytes): 70 6b 74 63 64 76 64 00 pktcdvd. backtrace: [<00000000e7c7703d>] __kmalloc_track_caller+0x1ae/0x320 [<000000005e4d70bc>] kstrdup+0x3a/0x70 [<00000000c2e5e85a>] kstrdup_const+0x68/0x80 [<000000000049a8c7>] kvasprintf_const+0x10b/0x190 [<0000000029123163>] kobject_set_name_vargs+0x56/0x150 [<00000000747219c9>] kobject_set_name+0xab/0xe0 [<0000000005f1ea4e>] __class_register+0x15c/0x49a If class_add_groups() fails, it need delete kobject and free its name, besides, subsys_private also need be freed. unreferenced object 0xffff888037274000 (size 1024): comm "modprobe", pid 502, jiffies 4294906074 (age 49.296s) hex dump (first 32 bytes): 00 40 27 37 80 88 ff ff 00 40 27 37 80 88 ff ff .@'7.....@'7.... 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... backtrace: [<00000000151f9600>] kmem_cache_alloc_trace+0x17c/0x2f0 [<00000000ecf3dd95>] __class_register+0x86/0x49a It can not call kset_put() or kset_unregister() in error path, because the 'cls' will be freed in callback function class_release() and it also freed in error path, it will cause double free. Signed-off-by: Yang Yingliang --- drivers/base/class.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/base/class.c b/drivers/base/class.c index 64f7b9a0970f..87de0a04ee9b 100644 --- a/drivers/base/class.c +++ b/drivers/base/class.c @@ -187,11 +187,17 @@ int __class_register(struct class *cls, struct lock_class_key *key) error = kset_register(&cp->subsys); if (error) { + kfree_const(cp->subsys.kobj.name); kfree(cp); return error; } error = class_add_groups(class_get(cls), cls->class_groups); class_put(cls); + if (error) { + kobject_del(&cp->subsys.kobj); + kfree_const(cp->subsys.kobj.name); + kfree(cp); + } return error; } EXPORT_SYMBOL_GPL(__class_register);