From: Zenghui Yu <yuzenghui@huawei.com>
To: <linux-wireless@vger.kernel.org>, <linux-kernel@vger.kernel.org>
Cc: <zajec5@gmail.com>, <kvalo@codeaurora.org>, <hauke@hauke-m.de>,
<linville@tuxdriver.com>, <wanghaibin.wang@huawei.com>,
Zenghui Yu <yuzenghui@huawei.com>
Subject: [PATCH 1/2] bcma: Fix memory leak for internally-handled cores
Date: Tue, 27 Jul 2021 10:52:31 +0800 [thread overview]
Message-ID: <20210727025232.663-2-yuzenghui@huawei.com> (raw)
In-Reply-To: <20210727025232.663-1-yuzenghui@huawei.com>
kmemleak reported that dev_name() of internally-handled cores were leaked
on driver unbinding. Let's use device_initialize() to take refcounts for
them and put_device() to properly free the related stuff.
While looking at it, there's another potential issue for those which should
be *registered* into driver core. If device_register() failed, we put
device once and freed bcma_device structures. In bcma_unregister_cores(),
they're treated as unregistered and we hit both UAF and double-free. That
smells not good and has also been fixed now.
Fixes: ab54bc8460b5 ("bcma: fill core details for every device")
Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
---
drivers/bcma/main.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 6535614a7dc1..1df2b5801c3b 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -236,6 +236,7 @@ EXPORT_SYMBOL(bcma_core_irq);
void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core)
{
+ device_initialize(&core->dev);
core->dev.release = bcma_release_core_dev;
core->dev.bus = &bcma_bus_type;
dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index);
@@ -277,11 +278,10 @@ static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core)
{
int err;
- err = device_register(&core->dev);
+ err = device_add(&core->dev);
if (err) {
bcma_err(bus, "Could not register dev for core 0x%03X\n",
core->id.id);
- put_device(&core->dev);
return;
}
core->dev_registered = true;
@@ -372,7 +372,7 @@ void bcma_unregister_cores(struct bcma_bus *bus)
/* Now noone uses internally-handled cores, we can free them */
list_for_each_entry_safe(core, tmp, &bus->cores, list) {
list_del(&core->list);
- kfree(core);
+ put_device(&core->dev);
}
}
--
2.19.1
next prev parent reply other threads:[~2021-07-27 2:53 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-27 2:52 two small bcma patches Zenghui Yu
2021-07-27 2:52 ` Zenghui Yu [this message]
2021-08-21 3:28 ` [PATCH 1/2] bcma: Fix memory leak for internally-handled cores Zenghui Yu
2021-08-21 10:05 ` Kalle Valo
2021-08-23 3:56 ` Zenghui Yu
2021-08-29 11:45 ` Kalle Valo
2021-07-27 2:52 ` [PATCH 2/2] bcma: Drop the unused parameter of bcma_scan_read32() Zenghui Yu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210727025232.663-2-yuzenghui@huawei.com \
--to=yuzenghui@huawei.com \
--cc=hauke@hauke-m.de \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=wanghaibin.wang@huawei.com \
--cc=zajec5@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).