mlxsw: core: Use devm_kzalloc to allocate mlxsw_hwmon structure
KASan reported use-after-free for the hwmon structure. So fix this by
using devm_kzalloc and let the core take care about freeing the memory
during device dettach.
Reported-by: Ido Schimmel <idosch@mellanox.com>
Fixes: 89309da39
("mlxsw: core: Implement temperature hwmon interface")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
2010b93e93
commit
f4cee3af0d
|
@ -855,7 +855,6 @@ int mlxsw_core_bus_device_register(const struct mlxsw_bus_info *mlxsw_bus_info,
|
||||||
err_debugfs_init:
|
err_debugfs_init:
|
||||||
mlxsw_core->driver->fini(mlxsw_core->driver_priv);
|
mlxsw_core->driver->fini(mlxsw_core->driver_priv);
|
||||||
err_driver_init:
|
err_driver_init:
|
||||||
mlxsw_hwmon_fini(mlxsw_core->hwmon);
|
|
||||||
err_hwmon_init:
|
err_hwmon_init:
|
||||||
mlxsw_emad_fini(mlxsw_core);
|
mlxsw_emad_fini(mlxsw_core);
|
||||||
err_emad_init:
|
err_emad_init:
|
||||||
|
@ -878,7 +877,6 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core)
|
||||||
|
|
||||||
mlxsw_core_debugfs_fini(mlxsw_core);
|
mlxsw_core_debugfs_fini(mlxsw_core);
|
||||||
mlxsw_core->driver->fini(mlxsw_core->driver_priv);
|
mlxsw_core->driver->fini(mlxsw_core->driver_priv);
|
||||||
mlxsw_hwmon_fini(mlxsw_core->hwmon);
|
|
||||||
mlxsw_emad_fini(mlxsw_core);
|
mlxsw_emad_fini(mlxsw_core);
|
||||||
mlxsw_core->bus->fini(mlxsw_core->bus_priv);
|
mlxsw_core->bus->fini(mlxsw_core->bus_priv);
|
||||||
kfree(mlxsw_core->lag.mapping);
|
kfree(mlxsw_core->lag.mapping);
|
||||||
|
|
|
@ -239,10 +239,6 @@ static inline int mlxsw_hwmon_init(struct mlxsw_core *mlxsw_core,
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline void mlxsw_hwmon_fini(struct mlxsw_hwmon *mlxsw_hwmon)
|
|
||||||
{
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
|
|
|
@ -334,7 +334,8 @@ int mlxsw_hwmon_init(struct mlxsw_core *mlxsw_core,
|
||||||
struct device *hwmon_dev;
|
struct device *hwmon_dev;
|
||||||
int err;
|
int err;
|
||||||
|
|
||||||
mlxsw_hwmon = kzalloc(sizeof(*mlxsw_hwmon), GFP_KERNEL);
|
mlxsw_hwmon = devm_kzalloc(mlxsw_bus_info->dev, sizeof(*mlxsw_hwmon),
|
||||||
|
GFP_KERNEL);
|
||||||
if (!mlxsw_hwmon)
|
if (!mlxsw_hwmon)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
mlxsw_hwmon->core = mlxsw_core;
|
mlxsw_hwmon->core = mlxsw_core;
|
||||||
|
@ -367,11 +368,5 @@ int mlxsw_hwmon_init(struct mlxsw_core *mlxsw_core,
|
||||||
err_hwmon_register:
|
err_hwmon_register:
|
||||||
err_fans_init:
|
err_fans_init:
|
||||||
err_temp_init:
|
err_temp_init:
|
||||||
kfree(mlxsw_hwmon);
|
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
|
||||||
void mlxsw_hwmon_fini(struct mlxsw_hwmon *mlxsw_hwmon)
|
|
||||||
{
|
|
||||||
kfree(mlxsw_hwmon);
|
|
||||||
}
|
|
||||||
|
|
Loading…
Reference in New Issue