iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers
History
Yanfei Xu bc5f2f3431 net: mdiobus: Fix memory leak in __mdiobus_register 
commit ab609f25d19858513919369ff3d9a63c02cd9e2e upstream.

Once device_register() failed, we should call put_device() to
decrement reference count for cleanup. Or it will cause memory
leak.

BUG: memory leak
unreferenced object 0xffff888114032e00 (size 256):
  comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff  ................
    08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff  .........ve.....
  backtrace:
    [<ffffffff8265cfab>] kmalloc include/linux/slab.h:591 [inline]
    [<ffffffff8265cfab>] kzalloc include/linux/slab.h:721 [inline]
    [<ffffffff8265cfab>] device_private_init drivers/base/core.c:3203 [inline]
    [<ffffffff8265cfab>] device_add+0x89b/0xdf0 drivers/base/core.c:3253
    [<ffffffff828dd643>] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537
    [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
    [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
    [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
    [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
    [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
    [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
    [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
    [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
    [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
    [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
    [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
    [<ffffffff82660916>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
    [<ffffffff8265cd0b>] device_add+0x5fb/0xdf0 drivers/base/core.c:3359
    [<ffffffff82c343b9>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170
    [<ffffffff82c4473c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238

BUG: memory leak
unreferenced object 0xffff888116f06900 (size 32):
  comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s)
  hex dump (first 32 bytes):
    75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00  usb-001:003.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81484516>] kstrdup+0x36/0x70 mm/util.c:60
    [<ffffffff814845a3>] kstrdup_const+0x53/0x80 mm/util.c:83
    [<ffffffff82296ba2>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
    [<ffffffff82358d4b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
    [<ffffffff826575f3>] dev_set_name+0x63/0x90 drivers/base/core.c:3147
    [<ffffffff828dd63b>] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535
    [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
    [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
    [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
    [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
    [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
    [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
    [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
    [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
    [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
    [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
    [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969

Reported-by: syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com
Signed-off-by: Yanfei Xu <yanfei.xu@windriver.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-10-27 09:34:01 +02:00
..
accessibility
…
acpi
ACPI: NFIT: Fix support for virtual SPA ranges
2021-08-26 08:37:22 -04:00
amba
amba: Fix resource leak for drivers without .remove
2021-03-03 17:44:38 +01:00
android
binder: Prevent context manager from incrementing ref 0
2020-08-21 11:01:55 +02:00
ata
pata_legacy: fix a couple uninitialized variable bugs
2021-10-27 09:33:59 +02:00
atm
atm: nicstar: register the interrupt handler in the right place
2021-07-20 16:21:08 +02:00
auxdisplay
…
base
PM / wakeirq: Fix unbalanced IRQ enable for wakeirq
2021-09-26 13:36:17 +02:00
bcma
bcma: Fix memory leak for internally-handled cores
2021-09-22 11:43:02 +02:00
block
cryptoloop: add a deprecation warning
2021-09-22 11:42:55 +02:00
bluetooth
Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
2021-07-20 16:21:08 +02:00
bus
bus: qcom: Put child node before return
2021-05-22 10:40:23 +02:00
cdrom
cdrom: gdrom: initialize global variable at init time
2021-05-26 11:29:07 +02:00
char
virtio_console: Assure used length from device is limited
2021-07-20 16:21:14 +02:00
clk
clk: kirkwood: Fix a clocking boot regression
2021-09-22 11:43:02 +02:00
clocksource
clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
2021-03-03 17:44:37 +01:00
connector
…
cpufreq
cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
2021-10-06 10:23:41 +02:00
cpuidle
cpuidle: Fix three reference count leaks
2020-06-20 10:24:18 +02:00
crypto
crypto: talitos - fix max key size for sha384 and sha512
2021-09-26 13:36:17 +02:00
dax
…
dca
…
devfreq
PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out
2020-10-01 20:40:02 +02:00
dio
…
dma
dmaengine: xilinx_dma: Set DMA mask for coherent APIs
2021-09-26 13:36:18 +02:00
dma-buf
…
edac
EDAC/synopsys: Fix wrong value type assignment for edac_mode
2021-10-06 10:23:42 +02:00
eisa
…
extcon
extcon: max8997: Add missing modalias string
2021-07-20 16:21:05 +02:00
firewire
firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
2021-04-07 12:05:40 +02:00
firmware
efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock()
2021-10-27 09:33:57 +02:00
fmc
…
fpga
…
gpio
gpio: zynq: Check return value of pm_runtime_get_sync
2021-07-20 16:21:12 +02:00
gpu
drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
2021-10-27 09:33:59 +02:00
hid
HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS
2021-10-17 10:05:40 +02:00
hsi
HSI: core: fix resource leaks in hsi_add_client_from_dt()
2021-05-22 10:40:26 +02:00
hv
Drivers: hv: vmbus: Increase wait time for VMbus unload
2021-05-22 10:40:24 +02:00
hwmon
hwmon: (tmp421) fix rounding for negative values
2021-10-06 10:23:41 +02:00
hwspinlock
…
hwtracing
intel_th: Consistency and off-by-one fix
2021-05-22 10:40:16 +02:00
i2c
i2c: mt65xx: fix IRQ check
2021-09-22 11:43:02 +02:00
ide
block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into <linux/blkdev.h>
2020-09-12 11:47:36 +02:00
idle
…
iio
iio: ssp_sensors: fix error code in ssp_print_mcu_debug()
2021-10-27 09:33:58 +02:00
infiniband
IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
2021-09-03 09:44:40 +02:00
input
Input: xpad - add support for another USB ID of Nacon GC-100
2021-10-27 09:33:57 +02:00
iommu
iommu/amd: Fix backport of 140456f994195b568ecd7fc2287a34eadffef3ca
2021-08-04 11:58:01 +02:00
ipack
ipack: ipoctal: fix module reference leak
2021-10-06 10:23:42 +02:00
irqchip
irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
2020-12-29 13:45:00 +01:00
isdn
isdn: mISDN: Fix sleeping function called from invalid context
2021-10-27 09:34:00 +02:00
leds
leds: ktd2692: Fix an error handling path
2021-07-20 16:21:05 +02:00
lguest
…
lightnvm
…
macintosh
drivers/macintosh: Fix memleak in windfarm_pm112 driver
2020-06-20 10:24:21 +02:00
mailbox
…
mcb
mcb: fix error handling in mcb_alloc_bus()
2021-10-06 10:23:39 +02:00
md
dm btree remove: assign new_root only when removal succeeds
2021-07-20 16:21:10 +02:00
media
media: rc-loopback: return number of emitters rather than error
2021-09-22 11:43:03 +02:00
memory
memory: fsl_ifc: fix leak of private memory on probe failure
2021-07-20 16:21:15 +02:00
memstick
memstick: r592: Fix error return in r592_probe()
2020-12-29 13:44:58 +01:00
message
scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
2020-11-10 10:23:57 +01:00
mfd
mfd: Don't use irq_create_mapping() to resolve a mapping
2021-09-22 11:43:10 +02:00
misc
cb710: avoid NULL pointer subtraction
2021-10-27 09:33:57 +02:00
mmc
mmc: rtsx_pci: Fix long reads when clock is prescaled
2021-09-22 11:43:07 +02:00
mtd
mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()'
2021-09-22 11:43:10 +02:00
net
net: mdiobus: Fix memory leak in __mdiobus_register
2021-10-27 09:34:01 +02:00
nfc
nfc: nfcsim: fix use after free during module unload
2021-08-04 11:58:03 +02:00
ntb
NTB: hw: amd: fix an issue about leak system resources
2020-10-29 09:05:41 +01:00
nubus
…
nvdimm
libnvdimm/dimm: Avoid race between probe and available_slots_show()
2021-03-03 17:44:44 +01:00
nvme
nvme-pci: Fix an error handling path in 'nvme_probe()'
2021-09-22 11:42:57 +02:00
nvmem
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
2021-10-27 09:33:58 +02:00
of
of: Fix truncation of memory sizes on 32-bit platforms
2021-07-20 16:21:05 +02:00
oprofile
…
parisc
parisc: Move pci_dev_is_behind_card_dino to where it is used
2021-09-26 13:36:18 +02:00
parport
parport: remove non-zero check on count
2021-09-22 11:43:07 +02:00
pci
PCI: Use pci_update_current_state() in pci_enable_device_flags()
2021-09-22 11:43:04 +02:00
pcmcia
pcmcia: i82092: fix a null pointer dereference bug
2021-08-15 13:01:03 +02:00
perf
…
phy
phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
2021-07-20 16:21:05 +02:00
pinctrl
pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
2021-09-22 11:43:04 +02:00
platform
platform/x86: intel_scu_ipc: Update timeout value in comment
2021-10-27 09:34:01 +02:00
pnp
…
power
power: supply: max17042: handle fails of reading status register
2021-09-22 11:43:03 +02:00
powercap
powercap: restrict energy meter to root access
2020-11-10 21:04:57 +01:00
pps
…
ps3
powerpc/ps3: use dma_mapping_error()
2020-12-29 13:45:00 +01:00
ptp
ptp_pch: Load module automatically if ID matches
2021-10-17 10:05:39 +02:00
pwm
pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered
2021-09-26 13:36:18 +02:00
rapidio
rapidio: handle create_workqueue() failure
2021-05-26 11:29:06 +02:00
ras
…
regulator
regulator: da9052: Ensure enough delay time for .set_voltage_time_sel
2021-07-20 16:20:59 +02:00
remoteproc
remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load
2021-02-23 13:59:14 +01:00
reset
reset: ti-syscon: fix to_ti_syscon_reset_data macro
2021-07-28 09:14:24 +02:00
rpmsg
…
rtc
rtc: tps65910: Correct driver module alias
2021-09-22 11:43:02 +02:00
s390
s390/sclp_vt220: fix console name to match device
2021-07-20 16:21:11 +02:00
sbus
…
scsi
scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
2021-10-17 10:05:40 +02:00
sfi
…
sh
…
sn
…
soc
soc: qcom: smsm: Fix missed interrupts if state changes while masked
2021-09-22 11:43:00 +02:00
spi
spi: Fix tegra20 build with CONFIG_PM=n
2021-10-06 10:23:40 +02:00
spmi
…
ssb
ssb: sdio: Don't overwrite const buffer if block_write fails
2021-07-20 16:20:57 +02:00
staging
staging: greybus: uart: fix tty use after free
2021-10-06 10:23:39 +02:00
target
scsi: target: Fix protect handling in WRITE SAME(32)
2021-07-28 09:14:27 +02:00
tc
…
thermal
thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
2021-09-26 13:36:18 +02:00
thunderbolt
…
tty
tty: Fix out-of-bound vmalloc access in imageblit
2021-10-06 10:23:41 +02:00
uio
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:10:53 +02:00
usb
USB: serial: option: add Telit LE910Cx composition 0x1204
2021-10-27 09:33:58 +02:00
uwb
…
vfio
vfio: Use config not menuconfig for VFIO_NOIOMMU
2021-09-22 11:43:04 +02:00
vhost
vringh: Use wiov->used to check for read/write desc order
2021-09-03 09:44:40 +02:00
video
video: fbdev: riva: Error out if 'pixclock' equals zero
2021-09-22 11:43:05 +02:00
virt
drivers/virt/fsl_hypervisor: Fix error handling path
2020-10-29 09:05:35 +01:00
virtio
virtio: Improve vq->broken access to avoid any compiler optimization
2021-09-03 09:44:40 +02:00
vlynq
…
vme
…
w1
w1: mxc_w1: Fix timeout resolution problem leading to bus error
2020-11-10 10:23:57 +01:00
watchdog
watchdog: aspeed: fix hardware timeout calculation
2021-07-20 16:21:14 +02:00
xen
xen/events: Fix race in set_evtchn_to_irq
2021-08-26 08:37:23 -04:00
zorro
…
Kconfig
…
Makefile
…