diff options
| author | Yang Yingliang <yangyingliang@huawei.com> | 2022-11-12 16:10:10 +0300 |
|---|---|---|
| committer | Martin K. Petersen <martin.petersen@oracle.com> | 2022-11-26 03:06:13 +0300 |
| commit | e6d773f93a49e0eda88a903a2a6542ca83380eb1 (patch) | |
| tree | 33ca2d7786fe0b0fd33066601513c4418f00d3ed | |
| parent | 47b6a122c7b69a876c7ee2fc064a26b09627de9d (diff) | |
| download | linux-e6d773f93a49e0eda88a903a2a6542ca83380eb1.tar.xz | |
scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper()
Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id
string array"), the name of device is allocated dynamically, it needs be
freed when device_register() returns error.
As comment of device_register() says, one should use put_device() to give
up the reference in the error path. Fix this by calling put_device(), then
the name can be freed in kobject_cleanup(), and sdbg_host is freed in
sdebug_release_adapter().
When the device release is not set, it means the device is not initialized.
We can not call put_device() in this case. Use kfree() to free memory.
Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221112131010.3757845-1-yangyingliang@huawei.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
| -rw-r--r-- | drivers/scsi/scsi_debug.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c index 19ad8e2aa07a..de3d3b1edaf5 100644 --- a/drivers/scsi/scsi_debug.c +++ b/drivers/scsi/scsi_debug.c @@ -7329,7 +7329,10 @@ clean: kfree(sdbg_devinfo->zstate); kfree(sdbg_devinfo); } - kfree(sdbg_host); + if (sdbg_host->dev.release) + put_device(&sdbg_host->dev); + else + kfree(sdbg_host); pr_warn("%s: failed, errno=%d\n", __func__, -error); return error; } |