diff options
| author | Zenghui Yu <yuzenghui@huawei.com> | 2021-07-27 10:52:31 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-09-22 11:47:55 +0200 |
| commit | 743a3ee3880e518ea714a09d40e08f0029674f3b (patch) | |
| tree | 3f203b5017c97166962f446357dba6883c50dfeb /drivers/bcma | |
| parent | dd6bfcc343aba78be8ca69b55599fd772da120f4 (diff) | |
| download | linux-stable-743a3ee3880e518ea714a09d40e08f0029674f3b.tar.gz linux-stable-743a3ee3880e518ea714a09d40e08f0029674f3b.tar.bz2 linux-stable-743a3ee3880e518ea714a09d40e08f0029674f3b.zip | |
bcma: Fix memory leak for internally-handled cores
[ Upstream commit b63aed3ff195130fef12e0af590f4838cf0201d8 ]
kmemleak reported that dev_name() of internally-handled cores were leaked
on driver unbinding. Let's use device_initialize() to take refcounts for
them and put_device() to properly free the related stuff.
While looking at it, there's another potential issue for those which should
be *registered* into driver core. If device_register() failed, we put
device once and freed bcma_device structures. In bcma_unregister_cores(),
they're treated as unregistered and we hit both UAF and double-free. That
smells not good and has also been fixed now.
Fixes: ab54bc8460b5 ("bcma: fill core details for every device")
Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210727025232.663-2-yuzenghui@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/bcma')
| -rw-r--r-- | drivers/bcma/main.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c index fc1f4acdd189..c0f203deaf0b 100644 --- a/drivers/bcma/main.c +++ b/drivers/bcma/main.c @@ -236,6 +236,7 @@ EXPORT_SYMBOL(bcma_core_irq); void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core) { + device_initialize(&core->dev); core->dev.release = bcma_release_core_dev; core->dev.bus = &bcma_bus_type; dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index); @@ -299,11 +300,10 @@ static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core) { int err; - err = device_register(&core->dev); + err = device_add(&core->dev); if (err) { bcma_err(bus, "Could not register dev for core 0x%03X\n", core->id.id); - put_device(&core->dev); return; } core->dev_registered = true; @@ -394,7 +394,7 @@ void bcma_unregister_cores(struct bcma_bus *bus) /* Now noone uses internally-handled cores, we can free them */ list_for_each_entry_safe(core, tmp, &bus->cores, list) { list_del(&core->list); - kfree(core); + put_device(&core->dev); } } |