lkml.org 
[lkml]   [2021]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 205/236] bcma: Fix memory leak for internally-handled cores
    Date
    From: Zenghui Yu <yuzenghui@huawei.com>

    [ Upstream commit b63aed3ff195130fef12e0af590f4838cf0201d8 ]

    kmemleak reported that dev_name() of internally-handled cores were leaked
    on driver unbinding. Let's use device_initialize() to take refcounts for
    them and put_device() to properly free the related stuff.

    While looking at it, there's another potential issue for those which should
    be *registered* into driver core. If device_register() failed, we put
    device once and freed bcma_device structures. In bcma_unregister_cores(),
    they're treated as unregistered and we hit both UAF and double-free. That
    smells not good and has also been fixed now.

    Fixes: ab54bc8460b5 ("bcma: fill core details for every device")
    Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20210727025232.663-2-yuzenghui@huawei.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/bcma/main.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
    index 6535614a7dc1..1df2b5801c3b 100644
    --- a/drivers/bcma/main.c
    +++ b/drivers/bcma/main.c
    @@ -236,6 +236,7 @@ EXPORT_SYMBOL(bcma_core_irq);

    void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core)
    {
    + device_initialize(&core->dev);
    core->dev.release = bcma_release_core_dev;
    core->dev.bus = &bcma_bus_type;
    dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index);
    @@ -277,11 +278,10 @@ static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core)
    {
    int err;

    - err = device_register(&core->dev);
    + err = device_add(&core->dev);
    if (err) {
    bcma_err(bus, "Could not register dev for core 0x%03X\n",
    core->id.id);
    - put_device(&core->dev);
    return;
    }
    core->dev_registered = true;
    @@ -372,7 +372,7 @@ void bcma_unregister_cores(struct bcma_bus *bus)
    /* Now noone uses internally-handled cores, we can free them */
    list_for_each_entry_safe(core, tmp, &bus->cores, list) {
    list_del(&core->list);
    - kfree(core);
    + put_device(&core->dev);
    }
    }

    --
    2.30.2


    \
     
     \ /
      Last update: 2021-09-13 15:51    [W:2.383 / U:0.236 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site