* [PATCH] iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask()
@ 2021-10-13 9:43 Yang Yingliang
2021-10-17 14:16 ` Jonathan Cameron
0 siblings, 1 reply; 3+ messages in thread
From: Yang Yingliang @ 2021-10-13 9:43 UTC (permalink / raw)
To: linux-kernel, linux-iio; +Cc: lars, jic23, ardeleanalex
When iio_buffer_wrap_attr() returns NULL or buffer->buffer_group.name alloc
fails, the 'attr' which is allocated in __iio_buffer_alloc_sysfs_and_mask()
is not freed, and cause memory leak.
unreferenced object 0xffff888014882a00 (size 64):
comm "i2c-adjd_s311-8", pid 424, jiffies 4294907737 (age 44.396s)
hex dump (first 32 bytes):
00 0f 8a 15 80 88 ff ff 00 0e 8a 15 80 88 ff ff ................
80 04 8a 15 80 88 ff ff 80 05 8a 15 80 88 ff ff ................
backtrace:
[<0000000021752e67>] __kmalloc+0x1af/0x3c0
[<0000000043e8305c>] iio_buffers_alloc_sysfs_and_mask+0xe73/0x1570 [industrialio]
[<00000000b7aa5a17>] __iio_device_register+0x483/0x1a30 [industrialio]
[<000000003fa0fb2f>] __devm_iio_device_register+0x23/0x90 [industrialio]
[<000000003ab040cf>] adjd_s311_probe+0x19c/0x200 [adjd_s311]
[<0000000080458969>] i2c_device_probe+0xa31/0xbe0
[<00000000e20678ad>] really_probe+0x299/0xc30
[<000000006bea9b27>] __driver_probe_device+0x357/0x500
[<00000000e1df10d4>] driver_probe_device+0x4e/0x140
[<0000000003661beb>] __device_attach_driver+0x257/0x340
[<000000005bb4aa26>] bus_for_each_drv+0x166/0x1e0
[<00000000272c5236>] __device_attach+0x272/0x420
[<00000000d52a96ae>] bus_probe_device+0x1eb/0x2a0
[<00000000129f7737>] device_add+0xbf0/0x1f90
[<000000005eed4e52>] i2c_new_client_device+0x622/0xb20
[<00000000b85a9c43>] new_device_store+0x1fa/0x420
This patch fix to free it before the error return.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 15097c7a1adc ("iio: buffer: wrap all buffer attributes into iio_dev_attr")
Fixes: d9a625744ed0 ("iio: core: merge buffer/ & scan_elements/ attributes")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
drivers/iio/industrialio-buffer.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 547a92d469ae..ae0912a14578 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -1536,6 +1536,7 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
sizeof(struct attribute *) * buffer_attrcount);
buffer_attrcount += ARRAY_SIZE(iio_buffer_attrs);
+ buffer->buffer_group.attrs = attr;
for (i = 0; i < buffer_attrcount; i++) {
struct attribute *wrapped;
@@ -1543,7 +1544,7 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
wrapped = iio_buffer_wrap_attr(buffer, attr[i]);
if (!wrapped) {
ret = -ENOMEM;
- goto error_free_scan_mask;
+ goto error_free_buffer_attrs;
}
attr[i] = wrapped;
}
@@ -1558,8 +1559,6 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
goto error_free_buffer_attrs;
}
- buffer->buffer_group.attrs = attr;
-
ret = iio_device_register_sysfs_group(indio_dev, &buffer->buffer_group);
if (ret)
goto error_free_buffer_attr_group_name;
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask()
2021-10-13 9:43 [PATCH] iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask() Yang Yingliang
@ 2021-10-17 14:16 ` Jonathan Cameron
2021-10-18 7:03 ` Alexandru Ardelean
0 siblings, 1 reply; 3+ messages in thread
From: Jonathan Cameron @ 2021-10-17 14:16 UTC (permalink / raw)
To: Yang Yingliang; +Cc: linux-kernel, linux-iio, lars, ardeleanalex
On Wed, 13 Oct 2021 17:43:43 +0800
Yang Yingliang <yangyingliang@huawei.com> wrote:
> When iio_buffer_wrap_attr() returns NULL or buffer->buffer_group.name alloc
> fails, the 'attr' which is allocated in __iio_buffer_alloc_sysfs_and_mask()
> is not freed, and cause memory leak.
>
> unreferenced object 0xffff888014882a00 (size 64):
> comm "i2c-adjd_s311-8", pid 424, jiffies 4294907737 (age 44.396s)
> hex dump (first 32 bytes):
> 00 0f 8a 15 80 88 ff ff 00 0e 8a 15 80 88 ff ff ................
> 80 04 8a 15 80 88 ff ff 80 05 8a 15 80 88 ff ff ................
> backtrace:
> [<0000000021752e67>] __kmalloc+0x1af/0x3c0
> [<0000000043e8305c>] iio_buffers_alloc_sysfs_and_mask+0xe73/0x1570 [industrialio]
> [<00000000b7aa5a17>] __iio_device_register+0x483/0x1a30 [industrialio]
> [<000000003fa0fb2f>] __devm_iio_device_register+0x23/0x90 [industrialio]
> [<000000003ab040cf>] adjd_s311_probe+0x19c/0x200 [adjd_s311]
> [<0000000080458969>] i2c_device_probe+0xa31/0xbe0
> [<00000000e20678ad>] really_probe+0x299/0xc30
> [<000000006bea9b27>] __driver_probe_device+0x357/0x500
> [<00000000e1df10d4>] driver_probe_device+0x4e/0x140
> [<0000000003661beb>] __device_attach_driver+0x257/0x340
> [<000000005bb4aa26>] bus_for_each_drv+0x166/0x1e0
> [<00000000272c5236>] __device_attach+0x272/0x420
> [<00000000d52a96ae>] bus_probe_device+0x1eb/0x2a0
> [<00000000129f7737>] device_add+0xbf0/0x1f90
> [<000000005eed4e52>] i2c_new_client_device+0x622/0xb20
> [<00000000b85a9c43>] new_device_store+0x1fa/0x420
>
> This patch fix to free it before the error return.
>
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Fixes: 15097c7a1adc ("iio: buffer: wrap all buffer attributes into iio_dev_attr")
> Fixes: d9a625744ed0 ("iio: core: merge buffer/ & scan_elements/ attributes")
> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Good find. This function is clearly trying to do too many things and hence has become
rather error prone. Still fixing that is a job for another day.
Alex, if you have a chance to take a look at this as well it would be great.
In the meantime I've queued it up in the fixes-togreg branch of iio.git
Thanks,
Jonathan
> ---
> drivers/iio/industrialio-buffer.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> index 547a92d469ae..ae0912a14578 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -1536,6 +1536,7 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
> sizeof(struct attribute *) * buffer_attrcount);
>
> buffer_attrcount += ARRAY_SIZE(iio_buffer_attrs);
> + buffer->buffer_group.attrs = attr;
>
> for (i = 0; i < buffer_attrcount; i++) {
> struct attribute *wrapped;
> @@ -1543,7 +1544,7 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
> wrapped = iio_buffer_wrap_attr(buffer, attr[i]);
> if (!wrapped) {
> ret = -ENOMEM;
> - goto error_free_scan_mask;
> + goto error_free_buffer_attrs;
> }
> attr[i] = wrapped;
> }
> @@ -1558,8 +1559,6 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
> goto error_free_buffer_attrs;
> }
>
> - buffer->buffer_group.attrs = attr;
> -
> ret = iio_device_register_sysfs_group(indio_dev, &buffer->buffer_group);
> if (ret)
> goto error_free_buffer_attr_group_name;
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask()
2021-10-17 14:16 ` Jonathan Cameron
@ 2021-10-18 7:03 ` Alexandru Ardelean
0 siblings, 0 replies; 3+ messages in thread
From: Alexandru Ardelean @ 2021-10-18 7:03 UTC (permalink / raw)
To: Jonathan Cameron; +Cc: Yang Yingliang, LKML, linux-iio, Lars-Peter Clausen
On Sun, Oct 17, 2021 at 5:12 PM Jonathan Cameron <jic23@kernel.org> wrote:
>
> On Wed, 13 Oct 2021 17:43:43 +0800
> Yang Yingliang <yangyingliang@huawei.com> wrote:
>
> > When iio_buffer_wrap_attr() returns NULL or buffer->buffer_group.name alloc
> > fails, the 'attr' which is allocated in __iio_buffer_alloc_sysfs_and_mask()
> > is not freed, and cause memory leak.
> >
> > unreferenced object 0xffff888014882a00 (size 64):
> > comm "i2c-adjd_s311-8", pid 424, jiffies 4294907737 (age 44.396s)
> > hex dump (first 32 bytes):
> > 00 0f 8a 15 80 88 ff ff 00 0e 8a 15 80 88 ff ff ................
> > 80 04 8a 15 80 88 ff ff 80 05 8a 15 80 88 ff ff ................
> > backtrace:
> > [<0000000021752e67>] __kmalloc+0x1af/0x3c0
> > [<0000000043e8305c>] iio_buffers_alloc_sysfs_and_mask+0xe73/0x1570 [industrialio]
> > [<00000000b7aa5a17>] __iio_device_register+0x483/0x1a30 [industrialio]
> > [<000000003fa0fb2f>] __devm_iio_device_register+0x23/0x90 [industrialio]
> > [<000000003ab040cf>] adjd_s311_probe+0x19c/0x200 [adjd_s311]
> > [<0000000080458969>] i2c_device_probe+0xa31/0xbe0
> > [<00000000e20678ad>] really_probe+0x299/0xc30
> > [<000000006bea9b27>] __driver_probe_device+0x357/0x500
> > [<00000000e1df10d4>] driver_probe_device+0x4e/0x140
> > [<0000000003661beb>] __device_attach_driver+0x257/0x340
> > [<000000005bb4aa26>] bus_for_each_drv+0x166/0x1e0
> > [<00000000272c5236>] __device_attach+0x272/0x420
> > [<00000000d52a96ae>] bus_probe_device+0x1eb/0x2a0
> > [<00000000129f7737>] device_add+0xbf0/0x1f90
> > [<000000005eed4e52>] i2c_new_client_device+0x622/0xb20
> > [<00000000b85a9c43>] new_device_store+0x1fa/0x420
> >
> > This patch fix to free it before the error return.
> >
> > Reported-by: Hulk Robot <hulkci@huawei.com>
> > Fixes: 15097c7a1adc ("iio: buffer: wrap all buffer attributes into iio_dev_attr")
> > Fixes: d9a625744ed0 ("iio: core: merge buffer/ & scan_elements/ attributes")
> > Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
>
> Good find. This function is clearly trying to do too many things and hence has become
> rather error prone. Still fixing that is a job for another day.
>
> Alex, if you have a chance to take a look at this as well it would be great.
> In the meantime I've queued it up in the fixes-togreg branch of iio.git
Yeah, this fix looks good.
It took me a while to follow the change.
No need to add my tag [anywhere] since this was sent already.
Looking at all these leak fixes coming in, I'm wondering where my head
was at, when doing these changes.
Thanks
Alex
>
> Thanks,
>
> Jonathan
>
> > ---
> > drivers/iio/industrialio-buffer.c | 5 ++---
> > 1 file changed, 2 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> > index 547a92d469ae..ae0912a14578 100644
> > --- a/drivers/iio/industrialio-buffer.c
> > +++ b/drivers/iio/industrialio-buffer.c
> > @@ -1536,6 +1536,7 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
> > sizeof(struct attribute *) * buffer_attrcount);
> >
> > buffer_attrcount += ARRAY_SIZE(iio_buffer_attrs);
> > + buffer->buffer_group.attrs = attr;
> >
> > for (i = 0; i < buffer_attrcount; i++) {
> > struct attribute *wrapped;
> > @@ -1543,7 +1544,7 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
> > wrapped = iio_buffer_wrap_attr(buffer, attr[i]);
> > if (!wrapped) {
> > ret = -ENOMEM;
> > - goto error_free_scan_mask;
> > + goto error_free_buffer_attrs;
> > }
> > attr[i] = wrapped;
> > }
> > @@ -1558,8 +1559,6 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
> > goto error_free_buffer_attrs;
> > }
> >
> > - buffer->buffer_group.attrs = attr;
> > -
> > ret = iio_device_register_sysfs_group(indio_dev, &buffer->buffer_group);
> > if (ret)
> > goto error_free_buffer_attr_group_name;
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-10-18 7:03 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-13 9:43 [PATCH] iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask() Yang Yingliang
2021-10-17 14:16 ` Jonathan Cameron
2021-10-18 7:03 ` Alexandru Ardelean
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.