Currently, if device_add() or device_add_disk() fail, the code jumps to the "out" label. Doing so we get a memory leak as Syzbot reports.[1] Fix this bug by jumping to the "out_free_index" label. [1] https://groups.google.com/g/syzkaller-bugs/c/BvuqG6YGb6I Reported-and-tested-by: syzbot+f08c77040fa163a75a46@xxxxxxxxxxxxxxxxxxxxxxxxx Fixes: 2a7a891f4c40 ("scsi: sd: Add error handling support for add_disk()") Fixes: 265dfe8ebbab ("scsi: sd: Free scsi_disk device via put_device()") Signed-off-by: Fabio M. De Francesco <fmdefrancesco@xxxxxxxxx> --- drivers/scsi/sd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index a390679cf458..61fcf653ef5a 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -3434,7 +3434,7 @@ static int sd_probe(struct device *dev) error = device_add(&sdkp->disk_dev); if (error) { put_device(&sdkp->disk_dev); - goto out; + goto out_free_index; } dev_set_drvdata(dev, sdkp); @@ -3475,7 +3475,7 @@ static int sd_probe(struct device *dev) error = device_add_disk(dev, gd, NULL); if (error) { put_device(&sdkp->disk_dev); - goto out; + goto out_free_index; } if (sdkp->capacity) -- 2.34.1
