lkml.org 
[lkml]   [2019]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 013/271] regmap: debugfs: Fix memory leak in regmap_debugfs_init
    Date
    [ Upstream commit 2899872b627e99b7586fe3b6c9f861da1b4d5072 ]

    As detected by kmemleak running on i.MX6ULL board:

    nreferenced object 0xd8366600 (size 64):
    comm "swapper/0", pid 1, jiffies 4294937370 (age 933.220s)
    hex dump (first 32 bytes):
    64 75 6d 6d 79 2d 69 6f 6d 75 78 63 2d 67 70 72 dummy-iomuxc-gpr
    40 32 30 65 34 30 30 30 00 e3 f3 ab fe d1 1b dd @20e4000........
    backtrace:
    [<b0402aec>] kasprintf+0x2c/0x54
    [<a6fbad2c>] regmap_debugfs_init+0x7c/0x31c
    [<9c8d91fa>] __regmap_init+0xb5c/0xcf4
    [<5b1c3d2a>] of_syscon_register+0x164/0x2c4
    [<596a5d80>] syscon_node_to_regmap+0x64/0x90
    [<49bd597b>] imx6ul_init_machine+0x34/0xa0
    [<250a4dac>] customize_machine+0x1c/0x30
    [<2d19fdaf>] do_one_initcall+0x7c/0x398
    [<e6084469>] kernel_init_freeable+0x328/0x448
    [<168c9101>] kernel_init+0x8/0x114
    [<913268aa>] ret_from_fork+0x14/0x20
    [<ce7b131a>] 0x0

    Root cause is that map->debugfs_name is allocated using kasprintf
    and then the pointer is lost by assigning it other memory address.

    Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
    Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/base/regmap/regmap-debugfs.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
    index 87b562e49a43..c9687c8b2347 100644
    --- a/drivers/base/regmap/regmap-debugfs.c
    +++ b/drivers/base/regmap/regmap-debugfs.c
    @@ -575,6 +575,8 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
    }

    if (!strcmp(name, "dummy")) {
    + kfree(map->debugfs_name);
    +
    map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d",
    dummy_index);
    name = map->debugfs_name;
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-07-24 22:09    [W:2.339 / U:0.384 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site