lkml.org 
[lkml]   [2016]   [Oct]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
Subject[BUG] errors in void transport_add_device() function
transport_add_device() is declared as void but it can actually fail.
Since the caller has no knowledge of the error, a later call to
transport_remove_device() may cause a kernel crash.

An example is a memory allocation error in this call path:

int device_private_init(struct device *dev)
{
dev->p = kzalloc(sizeof(*dev->p), GFP_KERNEL);

device_private_init
device_add
attribute_container_add_class_device
transport_add_class_device
attribute_container_device_trigger
transport_add_device


This results in a NULL pointer access in device_del():

if (parent)
klist_del(&dev->p->knode_parent);

klist_del
device_del
attribute_container_class_device_del
transport_remove_classdev
attribute_container_device_trigger
transport_remove_device

\
 
 \ /
  Last update: 2016-10-12 20:52    [W:0.021 / U:0.168 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site