Inject fault while loading module, kobject_add_varg() may fail.
If it fails, the kset.kobj.name allocated by kobject_set_name_vargs()
may be leaked, the call trace as follow:
unreferenced object 0xffff8884ef4fccc0 (size 32):
comm "modprobe", pid 56721, jiffies 4304802933
backtrace (crc 4b069391):
[<ffffffff85e9fb2b>] kmemleak_alloc+0x4b/0x80
[<ffffffff83664674>] __kmalloc_node_track_caller_noprof+0x3d4/0x510
[<ffffffff83510656>] kstrdup+0x46/0x80
[<ffffffff8351070f>] kstrdup_const+0x6f/0x90
[<ffffffff84213842>] kvasprintf_const+0x112/0x190
[<ffffffff85d8446b>] kobject_set_name_vargs+0x5b/0x160
[<ffffffff85d85969>] kobject_init_and_add+0xc9/0x170
[<ffffffff83661788>] sysfs_slab_add+0x188/0x230
[<ffffffff83665e24>] do_kmem_cache_create+0x4d4/0x5a0
[<ffffffff835343cd>] __kmem_cache_create_args+0x18d/0x310
[<ffffffffc64a08b4>] 0xffffffffc64a08b4
[<ffffffffc64a005f>] 0xffffffffc64a005f
[<ffffffff82a04198>] do_one_initcall+0xb8/0x590
[<ffffffff82f0c626>] do_init_module+0x256/0x7d0
[<ffffffff82f12f73>] load_module+0x5953/0x7010
[<ffffffff82f14b0a>] init_module_from_file+0xea/0x140
To mitigate this, we need to check return value of kobject_add_internal,
and free the name when an error is encountered.
Fixes: 244f6cee9a92 ("kobject: add kobject_add_ng function")
Signed-off-by: Gaosheng Cui <cuigaosheng1@xxxxxxxxxx>
---
lib/kobject.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/lib/kobject.c b/lib/kobject.c
index ecca72622933..365e2ad12cba 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -371,7 +371,13 @@ static __printf(3, 0) int kobject_add_varg(struct kobject *kobj,
return retval;
}
kobj->parent = parent;
- return kobject_add_internal(kobj);
+ retval = kobject_add_internal(kobj);
+ if (retval) {
+ kfree_const(kobj->name);
+ kobj->name = NULL;
+ }
+
+ return retval;
}
/**
--
2.25.1
