* [PATCH v2] kobject: fix possible memory leak in kset_create_and_add()
@ 2022-10-17 12:14 Yang Yingliang
0 siblings, 0 replies; only message in thread
From: Yang Yingliang @ 2022-10-17 12:14 UTC (permalink / raw)
To: linux-kernel; +Cc: gregkh, rafael
Inject fault while probing module (e.g. qemu_fw_cfg.ko), kset_register()
may fail in kset_create_and_add(), if it fails, but the refcount of kobject
is not decreased to 0, the name allocated in kset_create() is leaked. To fix
this by calling kset_put(), so that name can be freed in callback function
kobject_cleanup() and kset can be freed in kset_release().
unreferenced object 0xffff888103cc8c08 (size 8):
comm "modprobe", pid 508, jiffies 4294915182 (age 120.020s)
hex dump (first 8 bytes):
62 79 5f 6e 61 6d 65 00 by_name.
backtrace:
[<00000000572f97f9>] __kmalloc_track_caller+0x1ae/0x320
[<00000000a167a5cc>] kstrdup+0x3a/0x70
[<000000001cd0d05e>] kstrdup_const+0x68/0x80
[<00000000b9101e6d>] kvasprintf_const+0x10b/0x190
[<0000000088f2b8df>] kobject_set_name_vargs+0x56/0x150
[<000000003f8aca68>] kobject_set_name+0xab/0xe0
[<00000000249f7816>] kset_create_and_add+0x72/0x200
Fixes: b727c702896f ("kset: add kset_create_and_add function")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
v1 -> v2:
Update commit message.
---
lib/kobject.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/kobject.c b/lib/kobject.c
index a0b2dbfcfa23..f5e943c9027b 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -982,7 +982,7 @@ struct kset *kset_create_and_add(const char *name,
return NULL;
error = kset_register(kset);
if (error) {
- kfree(kset);
+ kset_put(kset);
return NULL;
}
return kset;
--
2.25.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2022-10-17 12:16 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-17 12:14 [PATCH v2] kobject: fix possible memory leak in kset_create_and_add() Yang Yingliang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).