hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

pstore/ram: Fix failure-path memory leak in ramoops_init 

As reported by nixiaoming, with some minor clarifications:

1) memory leak in ramoops_register_dummy():
   dummy_data = kzalloc(sizeof(*dummy_data), GFP_KERNEL);
   but no kfree() if platform_device_register_data() fails.

2) memory leak in ramoops_init():
   Missing platform_device_unregister(dummy) and kfree(dummy_data)
   if platform_driver_register(&ramoops_driver) fails.

I've clarified the purpose of ramoops_register_dummy(), and added a
common cleanup routine for all three failure paths to call.

Reported-by: nixiaoming <nixiaoming@huawei.com>
Cc: stable@vger.kernel.org
Cc: Anton Vorontsov <anton@enomsg.org>
Cc: Colin Cross <ccross@android.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Joel Fernandes <joelaf@google.com>
Cc: Geliang Tang <geliangtang@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
This commit is contained in:
Kees Cook 2018-09-28 15:17:50 -07:00
parent 831b624df1
commit bac6f6cda2
1 changed files with 25 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
fs/pstore/ram.c
View File

@ -898,8 +898,22 @@ static struct platform_driver ramoops_driver = {
},
};
static void ramoops_register_dummy(void)
static inline void ramoops_unregister_dummy(void)
{
platform_device_unregister(dummy);
dummy = NULL;
kfree(dummy_data);
dummy_data = NULL;
}
static void __init ramoops_register_dummy(void)
{
/*
* Prepare a dummy platform data structure to carry the module
* parameters. If mem_size isn't set, then there are no module
* parameters, and we can skip this.
*/
if (!mem_size)
return;
@ -932,21 +946,28 @@ static void ramoops_register_dummy(void)
if (IS_ERR(dummy)) {
pr_info("could not create platform device: %ld\n",
PTR_ERR(dummy));
dummy = NULL;
ramoops_unregister_dummy();
}
}
static int __init ramoops_init(void)
{
int ret;
ramoops_register_dummy();
return platform_driver_register(&ramoops_driver);
ret = platform_driver_register(&ramoops_driver);
if (ret != 0)
ramoops_unregister_dummy();
return ret;
}
late_initcall(ramoops_init);
static void __exit ramoops_exit(void)
{
platform_driver_unregister(&ramoops_driver);
platform_device_unregister(dummy);
kfree(dummy_data);
ramoops_unregister_dummy();
}
module_exit(ramoops_exit);