[PATCH 0/2] Drivers: hv: vmbus: fix two issues

[PATCH 0/2] Drivers: hv: vmbus: fix two issues

[Yang Yingliang]

This patchest fixes a double free and a memory leak problems.

Yang Yingliang (2):
  Drivers: hv: vmbus: fix double free in the error path of
    vmbus_add_channel_work()
  Drivers: hv: vmbus: fix possible memory leak in
    vmbus_device_register()

 drivers/hv/channel_mgmt.c | 1 -
 drivers/hv/vmbus_drv.c    | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

-- 
2.25.1

[PATCH 1/2] Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()

[Yang Yingliang]

In the error path of vmbus_device_register(), device_unregister() is
called, hv_device has already been freed in vmbus_device_release(),
remove the kfree() in vmbus_add_channel_work() to avoid double free.

Fixes: c2e5df616e1a ("vmbus: add per-channel sysfs info")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
 drivers/hv/channel_mgmt.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index 5b120402d405..7852e4d8911c 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -539,7 +539,6 @@ static void vmbus_add_channel_work(struct work_struct *work)
 	if (ret != 0) {
 		pr_err("unable to add child device object (relid %d)\n",
 			newchannel->offermsg.child_relid);
-		kfree(newchannel->device_obj);
 		goto err_deq_chan;
 	}
 
-- 
2.25.1

[PATCH 2/2] Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()

[Yang Yingliang]

If device_register() returns error in vmbus_device_register(),
the name allocated by dev_set_name() need be freed. As comment
of device_register() says, it should use put_device() to give
up the reference in the error path. So fix this by calling
put_device(), then the name can be freed in kobject_cleanup().

Fixes: 09d50ff8a233 ("Staging: hv: make the Hyper-V virtual bus code build")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
 drivers/hv/vmbus_drv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index 8b2e413bf19c..e592c481f7ae 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -2082,6 +2082,7 @@ int vmbus_device_register(struct hv_device *child_device_obj)
 	ret = device_register(&child_device_obj->device);
 	if (ret) {
 		pr_err("Unable to register child device\n");
+		put_device(&child_device_obj->device);
 		return ret;
 	}
 
-- 
2.25.1

RE: [PATCH 1/2] Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()

[Dexuan Cui]

> From: Yang Yingliang <yangyingliang@huawei.com>
> Sent: Wednesday, November 9, 2022 10:56 PM
> ...
> In the error path of vmbus_device_register(), device_unregister() is
> called, hv_device has already been freed in vmbus_device_release(),
> remove the kfree() in vmbus_add_channel_work() to avoid double free.

This is not obvious. Can you please add a comment for this before the
invokcation of vmbus_device_register() in vmbus_add_channel_work()?