lkml.org 
[lkml]   [2021]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 078/323] pinctrl: core: fix possible memory leak in pinctrl_enable()
    Date
    From: Yang Yingliang <yangyingliang@huawei.com>

    commit c7892ae13e461ed20154321eb792e07ebe38f5b3 upstream.

    I got memory leak as follows when doing fault injection test:

    unreferenced object 0xffff888020a7a680 (size 64):
    comm "i2c-mcp23018-41", pid 23090, jiffies 4295160544 (age 8.680s)
    hex dump (first 32 bytes):
    00 48 d3 1e 80 88 ff ff 00 1a 56 c1 ff ff ff ff .H........V.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    backtrace:
    [<0000000083c79b35>] kmem_cache_alloc_trace+0x16d/0x360
    [<0000000051803c95>] pinctrl_init_controller+0x6ed/0xb70
    [<0000000064346707>] pinctrl_register+0x27/0x80
    [<0000000029b0e186>] devm_pinctrl_register+0x5b/0xe0
    [<00000000391f5a3e>] mcp23s08_probe_one+0x968/0x118a [pinctrl_mcp23s08]
    [<000000006112c039>] mcp230xx_probe+0x266/0x560 [pinctrl_mcp23s08_i2c]

    If pinctrl_claim_hogs() fails, the 'pindesc' allocated in pinctrl_register_one_pin()
    need be freed.

    Cc: stable@vger.kernel.org
    Reported-by: Hulk Robot <hulkci@huawei.com>
    Fixes: 950b0d91dc10 ("pinctrl: core: Fix regression caused by delayed work for hogs")
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Link: https://lore.kernel.org/r/20211022014323.1156924-1-yangyingliang@huawei.com
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/pinctrl/core.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/drivers/pinctrl/core.c
    +++ b/drivers/pinctrl/core.c
    @@ -2038,6 +2038,8 @@ int pinctrl_enable(struct pinctrl_dev *p
    if (error) {
    dev_err(pctldev->dev, "could not claim hogs: %i\n",
    error);
    + pinctrl_free_pindescs(pctldev, pctldev->desc->pins,
    + pctldev->desc->npins);
    mutex_destroy(&pctldev->mutex);
    kfree(pctldev);


    \
     
     \ /
      Last update: 2021-11-24 13:57    [W:2.111 / U:0.752 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site