Messages in this thread Patch in this message | | | From | Pavel Skripkin <> | Subject | [PATCH] tty: n_gsm: add missing tty_kref_put | Date | Tue, 9 Nov 2021 13:39:30 +0300 |
| |
My local syzbot instance hit memory leak in gsmld_attach_gsm(). The reproducer injects allocation failure in tty_register_device(). After this error only previous tty_register_device() calls unwinded, but not tty_kref_get().
It leads to tty_struct leak, because ->close() won't be called in case of ->open() failure and nothing puts tty reference.
Fixes: 0a360e8b65d6 ("tty: n_gsm: check error while registering tty devices") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> --- drivers/tty/n_gsm.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 1d92d2a84889..1cc3aec17d2d 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2394,6 +2394,8 @@ static int gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm) for (i--; i >= 1; i--) tty_unregister_device(gsm_tty_driver, base + i); + + tty_kref_put(gsm->tty); return PTR_ERR(dev); } } -- 2.33.1
| |