Messages in this thread | | | Date | Mon, 4 Mar 2024 14:17:27 -0500 | From | Alan Stern <> | Subject | Bug in sysfs_break_active_protection() |
| |
Tejun:
It looks like there's a memory leak in sysfs_break_active_protection(). It and its companion routine do this:
struct kernfs_node *sysfs_break_active_protection(struct kobject *kobj, const struct attribute *attr) { struct kernfs_node *kn;
kobject_get(kobj); kn = kernfs_find_and_get(kobj->sd, attr->name); if (kn) kernfs_break_active_protection(kn); return kn; }
void sysfs_unbreak_active_protection(struct kernfs_node *kn) { struct kobject *kobj = kn->parent->priv;
kernfs_unbreak_active_protection(kn); kernfs_put(kn); kobject_put(kobj); }
If kn is NULL then the kobject_get(kobj) reference is never dropped. It looks like this could happen if two processes want to unregister the same kobject at the same time.
Shouldn't sysfs_break_active_protection() do this?
kobject_get(kobj); kn = kernfs_find_and_get(kobj->sd, attr->name); if (kn) kernfs_break_active_protection(kn); + else + kobject_put(kobj); return kn;
Alan Stern
| |