[PATCH -next 2/2] kobject: fix memory leak when kobject_add_varg() returns error

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Inject fault while loading module, kobject_add_varg() may fail.
If it fails, the kset.kobj.name allocated by kobject_set_name_vargs()
may be leaked, the call trace as follow:

unreferenced object 0xffff8884ef4fccc0 (size 32):
  comm "modprobe", pid 56721, jiffies 4304802933
  backtrace (crc 4b069391):
    [<ffffffff85e9fb2b>] kmemleak_alloc+0x4b/0x80
    [<ffffffff83664674>] __kmalloc_node_track_caller_noprof+0x3d4/0x510
    [<ffffffff83510656>] kstrdup+0x46/0x80
    [<ffffffff8351070f>] kstrdup_const+0x6f/0x90
    [<ffffffff84213842>] kvasprintf_const+0x112/0x190
    [<ffffffff85d8446b>] kobject_set_name_vargs+0x5b/0x160
    [<ffffffff85d85969>] kobject_init_and_add+0xc9/0x170
    [<ffffffff83661788>] sysfs_slab_add+0x188/0x230
    [<ffffffff83665e24>] do_kmem_cache_create+0x4d4/0x5a0
    [<ffffffff835343cd>] __kmem_cache_create_args+0x18d/0x310
    [<ffffffffc64a08b4>] 0xffffffffc64a08b4
    [<ffffffffc64a005f>] 0xffffffffc64a005f
    [<ffffffff82a04198>] do_one_initcall+0xb8/0x590
    [<ffffffff82f0c626>] do_init_module+0x256/0x7d0
    [<ffffffff82f12f73>] load_module+0x5953/0x7010
    [<ffffffff82f14b0a>] init_module_from_file+0xea/0x140

To mitigate this, we need to check return value of kobject_add_internal,
and free the name when an error is encountered.

Fixes: 244f6cee9a92 ("kobject: add kobject_add_ng function")
Signed-off-by: Gaosheng Cui <cuigaosheng1@xxxxxxxxxx>
---
 lib/kobject.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/kobject.c b/lib/kobject.c
index ecca72622933..365e2ad12cba 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -371,7 +371,13 @@ static __printf(3, 0) int kobject_add_varg(struct kobject *kobj,
 		return retval;
 	}
 	kobj->parent = parent;
-	return kobject_add_internal(kobj);
+	retval = kobject_add_internal(kobj);
+	if (retval) {
+		kfree_const(kobj->name);
+		kobj->name = NULL;
+	}
+
+	return retval;
 }
 
 /**
-- 
2.25.1





[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux