2019-05-17 23:34:12

by Eduardo Valentin

Subject: [PATCH 2/2] hwmon: core: fix potential memory leak in *hwmon_device_register*

When registering a hwmon device with HWMON_C_REGISTER_TZ flag
in place, the hwmon subsystem will attempt to register the device
also with the thermal subsystem. When the of-thermal registration
fails, __hwmon_device_register jumps to ida_remove, leaving
the locally allocated hwdev pointer and also the hdev registered.

This patch fixes both issues by jumping to a new label that
will first unregister hdev and the fall into the kfree of hwdev
to finally remove the idas and propagate the error code.

Cc: Jean Delvare <[email protected]>
Cc: Guenter Roeck <[email protected]>
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Eduardo Valentin <[email protected]>
---
drivers/hwmon/hwmon.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
index 6b3559f58b67..6f1194952189 100644
--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -637,7 +637,7 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
hwdev, j);
if (err) {
device_unregister(hdev);
- goto ida_remove;
+ goto device_unregister;
}
}
}
@@ -646,6 +646,8 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,

return hdev;

+device_unregister:
+ device_unregister(hdev);
free_hwmon:
kfree(hwdev);
ida_remove:
--
2.21.0

2019-05-28 15:37:57

by Guenter Roeck

Subject: Re: [PATCH 2/2] hwmon: core: fix potential memory leak in *hwmon_device_register*

Hi Eduardo,

On Fri, May 17, 2019 at 04:13:37PM -0700, Eduardo Valentin wrote:
> When registering a hwmon device with HWMON_C_REGISTER_TZ flag
> in place, the hwmon subsystem will attempt to register the device
> also with the thermal subsystem. When the of-thermal registration
> fails, __hwmon_device_register jumps to ida_remove, leaving
> the locally allocated hwdev pointer and also the hdev registered.
>
> This patch fixes both issues by jumping to a new label that
> will first unregister hdev and the fall into the kfree of hwdev
> to finally remove the idas and propagate the error code.
>
> Cc: Jean Delvare <[email protected]>
> Cc: Guenter Roeck <[email protected]>
> Cc: [email protected]
> Cc: [email protected]
> Signed-off-by: Eduardo Valentin <[email protected]>
> ---
> drivers/hwmon/hwmon.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
> index 6b3559f58b67..6f1194952189 100644
> --- a/drivers/hwmon/hwmon.c
> +++ b/drivers/hwmon/hwmon.c
> @@ -637,7 +637,7 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
> hwdev, j);
> if (err) {
> device_unregister(hdev);
> - goto ida_remove;
> + goto device_unregister;

Good find, but device_unregister() is already called above.
You need to either remove that, or replace the goto to point to free_hwmon.
The new label would probably the cleaner solution since it follows the
coding style.

Thanks
Guenter

> }
> }
> }
> @@ -646,6 +646,8 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
>
> return hdev;
>
> +device_unregister:
> + device_unregister(hdev);
> free_hwmon:
> kfree(hwdev);
> ida_remove:
> --
> 2.21.0
>

2019-05-29 23:16:10

by Eduardo Valentin

Subject: Re: [PATCH 2/2] hwmon: core: fix potential memory leak in *hwmon_device_register*

On Tue, May 28, 2019 at 08:06:40AM -0700, Guenter Roeck wrote:
> Hi Eduardo,
>
> On Fri, May 17, 2019 at 04:13:37PM -0700, Eduardo Valentin wrote:
> > When registering a hwmon device with HWMON_C_REGISTER_TZ flag
> > in place, the hwmon subsystem will attempt to register the device
> > also with the thermal subsystem. When the of-thermal registration
> > fails, __hwmon_device_register jumps to ida_remove, leaving
> > the locally allocated hwdev pointer and also the hdev registered.
> >
> > This patch fixes both issues by jumping to a new label that
> > will first unregister hdev and the fall into the kfree of hwdev
> > to finally remove the idas and propagate the error code.
> >
> > Cc: Jean Delvare <[email protected]>
> > Cc: Guenter Roeck <[email protected]>
> > Cc: [email protected]
> > Cc: [email protected]
> > Signed-off-by: Eduardo Valentin <[email protected]>
> > ---
> > drivers/hwmon/hwmon.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
> > index 6b3559f58b67..6f1194952189 100644
> > --- a/drivers/hwmon/hwmon.c
> > +++ b/drivers/hwmon/hwmon.c
> > @@ -637,7 +637,7 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
> > hwdev, j);
> > if (err) {
> > device_unregister(hdev);
> > - goto ida_remove;
> > + goto device_unregister;
>
> Good find, but device_unregister() is already called above.
> You need to either remove that, or replace the goto to point to free_hwmon.
> The new label would probably the cleaner solution since it follows the
> coding style.

Right, somehow I completely missed that unregister call. In any case, I will
take the route of adding a new label and remove the unregister call above.

>
> Thanks
> Guenter
>
> > }
> > }
> > }
> > @@ -646,6 +646,8 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
> >
> > return hdev;
> >
> > +device_unregister:
> > + device_unregister(hdev);
> > free_hwmon:
> > kfree(hwdev);
> > ida_remove:
> > --
> > 2.21.0
> >

--
All the best,
Eduardo Valentin