lkml.org 
[lkml]   [2018]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] fmc: Fix memory leak and NULL pointer dereference
Date
There is no deallocation of fmc memory, allocated at ff_dev_create()
by kmemdup(), and no check on kmemdup() success.

The patch adds deallocation into ff_dev_release() and adds check on
allocation success.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
---
drivers/fmc/fmc-fakedev.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/fmc/fmc-fakedev.c b/drivers/fmc/fmc-fakedev.c
index 941d0930969a..ede589f4e8e5 100644
--- a/drivers/fmc/fmc-fakedev.c
+++ b/drivers/fmc/fmc-fakedev.c
@@ -244,7 +244,10 @@ static struct fmc_operations ff_fmc_operations = {
/* This device is kmalloced: release it */
static void ff_dev_release(struct device *dev)
{
+ int i;
struct ff_dev *ff = container_of(dev, struct ff_dev, dev);
+ for (i = 0; i < ff_nr_dev; i++)
+ kfree(ff->fmc[i]);
kfree(ff);
}

@@ -273,15 +276,17 @@ static struct ff_dev *ff_dev_create(void)
ff->dev.release = ff_dev_release;

ret = device_register(&ff->dev);
- if (ret < 0) {
- put_device(&ff->dev);
- return ERR_PTR(ret);
- }
+ if (ret < 0)
+ goto err;

/* Create fmc structures that refer to this new "hw" device */
for (i = 0; i < ff_nr_dev; i++) {
fmc = kmemdup(&ff_template_fmc, sizeof(ff_template_fmc),
GFP_KERNEL);
+ if (!fmc) {
+ ret = -ENOMEM;
+ goto err;
+ }
fmc->hwdev = &ff->dev;
fmc->carrier_data = ff;
fmc->nr_slots = ff_nr_dev;
@@ -294,6 +299,10 @@ static struct ff_dev *ff_dev_create(void)
ff_template_fmc.device_id++;
}
return ff;
+
+err:
+ put_device(&ff->dev);
+ return ERR_PTR(ret);
}

/* init and exit */
--
2.18.0
\
 
 \ /
  Last update: 2018-07-27 17:03    [W:0.026 / U:22.696 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site