Messages in this thread | | | From | Tahsin Erdogan <> | Date | Wed, 12 Oct 2016 11:51:47 -0700 | Subject | [BUG] errors in void transport_add_device() function |
| |
transport_add_device() is declared as void but it can actually fail. Since the caller has no knowledge of the error, a later call to transport_remove_device() may cause a kernel crash.
An example is a memory allocation error in this call path:
int device_private_init(struct device *dev) { dev->p = kzalloc(sizeof(*dev->p), GFP_KERNEL);
device_private_init device_add attribute_container_add_class_device transport_add_class_device attribute_container_device_trigger transport_add_device
This results in a NULL pointer access in device_del():
if (parent) klist_del(&dev->p->knode_parent);
klist_del device_del attribute_container_class_device_del transport_remove_classdev attribute_container_device_trigger transport_remove_device
| |