2020-06-02 12:12:46

by Wang Hai

Subject: [PATCH] cxl: Fix kobject memleak

Currently the error return path from kobject_init_and_add() is not
followed by a call to kobject_put() - which means we are leaking
the kobject.

Fix it by adding a call to kobject_put() in the error path of
kobject_init_and_add().

Fixes: b087e6190ddc ("cxl: Export optional AFU configuration record in sysfs")
Reported-by: Hulk Robot <[email protected]>
Signed-off-by: Wang Hai <[email protected]>
---
drivers/misc/cxl/sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
index f0263d1..d97a243 100644
--- a/drivers/misc/cxl/sysfs.c
+++ b/drivers/misc/cxl/sysfs.c
@@ -624,7 +624,7 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c
rc = kobject_init_and_add(&cr->kobj, &afu_config_record_type,
&afu->dev.kobj, "cr%i", cr->cr);
if (rc)
- goto err;
+ goto err1;

rc = sysfs_create_bin_file(&cr->kobj, &cr->config_attr);
if (rc)
--
1.8.3.1

2020-06-02 16:24:03

by Frederic Barrat

Subject: Re: [PATCH] cxl: Fix kobject memleak

Le 02/06/2020 à 14:07, Wang Hai a écrit :
> Currently the error return path from kobject_init_and_add() is not
> followed by a call to kobject_put() - which means we are leaking
> the kobject.
>
> Fix it by adding a call to kobject_put() in the error path of
> kobject_init_and_add().
>
> Fixes: b087e6190ddc ("cxl: Export optional AFU configuration record in sysfs")
> Reported-by: Hulk Robot <[email protected]>
> Signed-off-by: Wang Hai <[email protected]>


Indeed, a call to kobject_put() is needed when the init fails.
Thanks!
Acked-by: Frederic Barrat <[email protected]>


> ---
> drivers/misc/cxl/sysfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
> index f0263d1..d97a243 100644
> --- a/drivers/misc/cxl/sysfs.c
> +++ b/drivers/misc/cxl/sysfs.c
> @@ -624,7 +624,7 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c
> rc = kobject_init_and_add(&cr->kobj, &afu_config_record_type,
> &afu->dev.kobj, "cr%i", cr->cr);
> if (rc)
> - goto err;
> + goto err1;
>
> rc = sysfs_create_bin_file(&cr->kobj, &cr->config_attr);
> if (rc)
>

2020-06-03 11:37:12

by Andrew Donnellan

Subject: Re: [PATCH] cxl: Fix kobject memleak

On 2/6/20 10:07 pm, Wang Hai wrote:
> Currently the error return path from kobject_init_and_add() is not
> followed by a call to kobject_put() - which means we are leaking
> the kobject.
>
> Fix it by adding a call to kobject_put() in the error path of
> kobject_init_and_add().
>
> Fixes: b087e6190ddc ("cxl: Export optional AFU configuration record in sysfs")
> Reported-by: Hulk Robot <[email protected]>
> Signed-off-by: Wang Hai <[email protected]>

Thanks for the fix!

I note that the err1 label returns without calling kfree(cr) and I can't
see a reason why we do that - so perhaps we should remove the return
statement in err1: so it falls through?

--
Andrew Donnellan OzLabs, ADL Canberra
[email protected] IBM Australia Limited

2020-06-03 12:02:13

by Wang Hai

Subject: Re: [PATCH] cxl: Fix kobject memleak

在 2020/6/3 19:33, Andrew Donnellan 写道:
> On 2/6/20 10:07 pm, Wang Hai wrote:
>> Currently the error return path from kobject_init_and_add() is not
>> followed by a call to kobject_put() - which means we are leaking
>> the kobject.
>>
>> Fix it by adding a call to kobject_put() in the error path of
>> kobject_init_and_add().
>>
>> Fixes: b087e6190ddc ("cxl: Export optional AFU configuration record
>> in sysfs")
>> Reported-by: Hulk Robot <[email protected]>
>> Signed-off-by: Wang Hai <[email protected]>
>
> Thanks for the fix!
>
> I note that the err1 label returns without calling kfree(cr) and I
> can't see a reason why we do that - so perhaps we should remove the
> return statement in err1: so it falls through?
>
kfree(cr) can be called when
kobject_put()-->kobject_release()-->kobject_cleanup()-->kobj_type->release()
is called.  The kobj_type here is afu_config_record_type


Thanks,

Wang Hai

2020-06-04 00:12:03

by Andrew Donnellan

Subject: Re: [PATCH] cxl: Fix kobject memleak

On 3/6/20 9:57 pm, wanghai (M) wrote:
> kfree(cr) can be called when
> kobject_put()-->kobject_release()-->kobject_cleanup()-->kobj_type->release()
> is called.  The kobj_type here is afu_config_record_type

Of course, I missed that.

In that case

Acked-by: Andrew Donnellan <[email protected]>

Thanks for the fix!

--
Andrew Donnellan OzLabs, ADL Canberra
[email protected] IBM Australia Limited