lkml.org 
[lkml]   [2021]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 49/53] iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
    Date
    From: Yang Yingliang <yangyingliang@huawei.com>

    commit 70c9774e180d151abaab358108e3510a8e615215 upstream.

    When ACPI type is ACPI_SMO8500, the data->dready_trig will not be set, the
    memory allocated by iio_triggered_buffer_setup() will not be freed, and cause
    memory leak as follows:

    unreferenced object 0xffff888009551400 (size 512):
    comm "i2c-SMO8500-125", pid 911, jiffies 4294911787 (age 83.852s)
    hex dump (first 32 bytes):
    02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    00 00 00 00 00 00 00 00 20 e2 e5 c0 ff ff ff ff ........ .......
    backtrace:
    [<0000000041ce75ee>] kmem_cache_alloc_trace+0x16d/0x360
    [<000000000aeb17b0>] iio_kfifo_allocate+0x41/0x130 [kfifo_buf]
    [<000000004b40c1f5>] iio_triggered_buffer_setup_ext+0x2c/0x210 [industrialio_triggered_buffer]
    [<000000004375b15f>] kxcjk1013_probe+0x10c3/0x1d81 [kxcjk_1013]

    Fix it by remove data->dready_trig condition in probe and remove.

    Reported-by: Hulk Robot <hulkci@huawei.com>
    Fixes: a25691c1f967 ("iio: accel: kxcjk1013: allow using an external trigger")
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Cc: <Stable@vger.kernel.org>
    Reviewed-by: Hans de Goede <hdegoede@redhat.com>
    Link: https://lore.kernel.org/r/20211025124159.2700301-1-yangyingliang@huawei.com
    Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/iio/accel/kxcjk-1013.c | 5 ++---
    1 file changed, 2 insertions(+), 3 deletions(-)

    --- a/drivers/iio/accel/kxcjk-1013.c
    +++ b/drivers/iio/accel/kxcjk-1013.c
    @@ -1326,8 +1326,7 @@ static int kxcjk1013_probe(struct i2c_cl
    return 0;

    err_buffer_cleanup:
    - if (data->dready_trig)
    - iio_triggered_buffer_cleanup(indio_dev);
    + iio_triggered_buffer_cleanup(indio_dev);
    err_trigger_unregister:
    if (data->dready_trig)
    iio_trigger_unregister(data->dready_trig);
    @@ -1350,8 +1349,8 @@ static int kxcjk1013_remove(struct i2c_c
    pm_runtime_set_suspended(&client->dev);
    pm_runtime_put_noidle(&client->dev);

    + iio_triggered_buffer_cleanup(indio_dev);
    if (data->dready_trig) {
    - iio_triggered_buffer_cleanup(indio_dev);
    iio_trigger_unregister(data->dready_trig);
    iio_trigger_unregister(data->motion_trig);
    }

    \
     
     \ /
      Last update: 2021-12-13 10:42    [W:4.310 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site