From: Yang Yingliang <yangyingliang@huawei.com>
To: <linux-kernel@vger.kernel.org>, <linux-iio@vger.kernel.org>
Cc: <lars@metafoo.de>, <jic23@kernel.org>, <ardeleanalex@gmail.com>
Subject: [PATCH] iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask()
Date: Wed, 13 Oct 2021 17:43:43 +0800 [thread overview]
Message-ID: <20211013094343.315275-1-yangyingliang@huawei.com> (raw)
When iio_buffer_wrap_attr() returns NULL or buffer->buffer_group.name alloc
fails, the 'attr' which is allocated in __iio_buffer_alloc_sysfs_and_mask()
is not freed, and cause memory leak.
unreferenced object 0xffff888014882a00 (size 64):
comm "i2c-adjd_s311-8", pid 424, jiffies 4294907737 (age 44.396s)
hex dump (first 32 bytes):
00 0f 8a 15 80 88 ff ff 00 0e 8a 15 80 88 ff ff ................
80 04 8a 15 80 88 ff ff 80 05 8a 15 80 88 ff ff ................
backtrace:
[<0000000021752e67>] __kmalloc+0x1af/0x3c0
[<0000000043e8305c>] iio_buffers_alloc_sysfs_and_mask+0xe73/0x1570 [industrialio]
[<00000000b7aa5a17>] __iio_device_register+0x483/0x1a30 [industrialio]
[<000000003fa0fb2f>] __devm_iio_device_register+0x23/0x90 [industrialio]
[<000000003ab040cf>] adjd_s311_probe+0x19c/0x200 [adjd_s311]
[<0000000080458969>] i2c_device_probe+0xa31/0xbe0
[<00000000e20678ad>] really_probe+0x299/0xc30
[<000000006bea9b27>] __driver_probe_device+0x357/0x500
[<00000000e1df10d4>] driver_probe_device+0x4e/0x140
[<0000000003661beb>] __device_attach_driver+0x257/0x340
[<000000005bb4aa26>] bus_for_each_drv+0x166/0x1e0
[<00000000272c5236>] __device_attach+0x272/0x420
[<00000000d52a96ae>] bus_probe_device+0x1eb/0x2a0
[<00000000129f7737>] device_add+0xbf0/0x1f90
[<000000005eed4e52>] i2c_new_client_device+0x622/0xb20
[<00000000b85a9c43>] new_device_store+0x1fa/0x420
This patch fix to free it before the error return.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 15097c7a1adc ("iio: buffer: wrap all buffer attributes into iio_dev_attr")
Fixes: d9a625744ed0 ("iio: core: merge buffer/ & scan_elements/ attributes")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
drivers/iio/industrialio-buffer.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 547a92d469ae..ae0912a14578 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -1536,6 +1536,7 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
sizeof(struct attribute *) * buffer_attrcount);
buffer_attrcount += ARRAY_SIZE(iio_buffer_attrs);
+ buffer->buffer_group.attrs = attr;
for (i = 0; i < buffer_attrcount; i++) {
struct attribute *wrapped;
@@ -1543,7 +1544,7 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
wrapped = iio_buffer_wrap_attr(buffer, attr[i]);
if (!wrapped) {
ret = -ENOMEM;
- goto error_free_scan_mask;
+ goto error_free_buffer_attrs;
}
attr[i] = wrapped;
}
@@ -1558,8 +1559,6 @@ static int __iio_buffer_alloc_sysfs_and_mask(struct iio_buffer *buffer,
goto error_free_buffer_attrs;
}
- buffer->buffer_group.attrs = attr;
-
ret = iio_device_register_sysfs_group(indio_dev, &buffer->buffer_group);
if (ret)
goto error_free_buffer_attr_group_name;
--
2.25.1
next reply other threads:[~2021-10-13 9:36 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-13 9:43 Yang Yingliang [this message]
2021-10-17 14:16 ` [PATCH] iio: buffer: Fix memory leak in __iio_buffer_alloc_sysfs_and_mask() Jonathan Cameron
2021-10-18 7:03 ` Alexandru Ardelean
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211013094343.315275-1-yangyingliang@huawei.com \
--to=yangyingliang@huawei.com \
--cc=ardeleanalex@gmail.com \
--cc=jic23@kernel.org \
--cc=lars@metafoo.de \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.