lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 191/849] iio: buffer: Fix memory leak in iio_buffers_alloc_sysfs_and_mask()
    Date
    From: Yang Yingliang <yangyingliang@huawei.com>

    commit 486a25084155bf633768c26f022201c051d6fd95 upstream.

    When 'iio_dev_opaque->buffer_ioctl_handler' alloc fails in
    iio_buffers_alloc_sysfs_and_mask(), the 'attrs' allocated in
    iio_buffer_register_legacy_sysfs_groups() will be leaked:

    unreferenced object 0xffff888108568d00 (size 128):
    comm "88", pid 2014, jiffies 4294963294 (age 26.920s)
    hex dump (first 32 bytes):
    80 3e da 02 80 88 ff ff 00 3a da 02 80 88 ff ff .>.......:......
    00 35 da 02 80 88 ff ff 00 38 da 02 80 88 ff ff .5.......8......
    backtrace:
    [<0000000095a9e51e>] __kmalloc+0x1a3/0x2f0
    [<00000000faa3735e>] iio_buffers_alloc_sysfs_and_mask+0xfa3/0x1480 [industrialio]
    [<00000000a46384dc>] __iio_device_register+0x52e/0x1b40 [industrialio]
    [<00000000210af05e>] __devm_iio_device_register+0x22/0x80 [industrialio]
    [<00000000730d7b41>] adjd_s311_probe+0x195/0x200 [adjd_s311]
    [<00000000c0f70eb9>] i2c_device_probe+0xa07/0xbb0

    The iio_buffer_register_legacy_sysfs_groups() is
    called in __iio_buffer_alloc_sysfs_and_mask(),
    so move the iio_buffer_unregister_legacy_sysfs_groups()
    into __iio_buffer_free_sysfs_and_mask(), then the memory
    will be freed.

    Reported-by: Hulk Robot <hulkci@huawei.com>
    Fixes: d9a625744ed0 ("iio: core: merge buffer/ & scan_elements/ attributes")
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Link: https://lore.kernel.org/r/20211018063718.1971240-1-yangyingliang@huawei.com
    Cc: <Stable@vger.kernel.org>
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/iio/industrialio-buffer.c | 12 +++++++-----
    1 file changed, 7 insertions(+), 5 deletions(-)

    --- a/drivers/iio/industrialio-buffer.c
    +++ b/drivers/iio/industrialio-buffer.c
    @@ -1587,8 +1587,12 @@ error_cleanup_dynamic:
    return ret;
    }

    -static void __iio_buffer_free_sysfs_and_mask(struct iio_buffer *buffer)
    +static void __iio_buffer_free_sysfs_and_mask(struct iio_buffer *buffer,
    + struct iio_dev *indio_dev,
    + int index)
    {
    + if (index == 0)
    + iio_buffer_unregister_legacy_sysfs_groups(indio_dev);
    bitmap_free(buffer->scan_mask);
    kfree(buffer->buffer_group.name);
    kfree(buffer->buffer_group.attrs);
    @@ -1642,7 +1646,7 @@ int iio_buffers_alloc_sysfs_and_mask(str
    error_unwind_sysfs_and_mask:
    for (; unwind_idx >= 0; unwind_idx--) {
    buffer = iio_dev_opaque->attached_buffers[unwind_idx];
    - __iio_buffer_free_sysfs_and_mask(buffer);
    + __iio_buffer_free_sysfs_and_mask(buffer, indio_dev, unwind_idx);
    }
    return ret;
    }
    @@ -1659,11 +1663,9 @@ void iio_buffers_free_sysfs_and_mask(str
    iio_device_ioctl_handler_unregister(iio_dev_opaque->buffer_ioctl_handler);
    kfree(iio_dev_opaque->buffer_ioctl_handler);

    - iio_buffer_unregister_legacy_sysfs_groups(indio_dev);
    -
    for (i = iio_dev_opaque->attached_buffers_cnt - 1; i >= 0; i--) {
    buffer = iio_dev_opaque->attached_buffers[i];
    - __iio_buffer_free_sysfs_and_mask(buffer);
    + __iio_buffer_free_sysfs_and_mask(buffer, indio_dev, i);
    }
    }


    \
     
     \ /
      Last update: 2021-11-16 02:43    [W:3.455 / U:0.580 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site