Messages in this thread Patch in this message | | | Date | Tue, 9 Nov 2021 18:33:14 +0100 | Subject | Re: [PATCH] tty: n_gsm: add missing tty_kref_put | From | Jiri Slaby <> |
| |
On 09. 11. 21, 11:39, Pavel Skripkin wrote: > My local syzbot instance hit memory leak in gsmld_attach_gsm(). The > reproducer injects allocation failure in tty_register_device(). After > this error only previous tty_register_device() calls unwinded, but not > tty_kref_get(). > > It leads to tty_struct leak, because ->close() won't be called in case > of ->open() failure and nothing puts tty reference.
I don't have time to check the n_gsm case now (like: are you talking about tty->open/close or file_ops->open/close -- they behave differently), but tty definitely calls close even if open fails.
> Fixes: 0a360e8b65d6 ("tty: n_gsm: check error while registering tty devices") > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> > --- > drivers/tty/n_gsm.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c > index 1d92d2a84889..1cc3aec17d2d 100644 > --- a/drivers/tty/n_gsm.c > +++ b/drivers/tty/n_gsm.c > @@ -2394,6 +2394,8 @@ static int gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm) > for (i--; i >= 1; i--) > tty_unregister_device(gsm_tty_driver, > base + i); > + > + tty_kref_put(gsm->tty); > return PTR_ERR(dev); > } > } >
-- js suse labs
| |