mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-21 18:11:39 +00:00
d08af40340
kmemleak reported a sequence of memory leaks, and one of them indicated we
failed to free a pointer:
comm "mount", pid 19610, jiffies 4297086464 (age 60.635s)
hex dump (first 8 bytes):
73 64 61 00 81 88 ff ff sda.....
backtrace:
[<00000000d77f3e04>] kstrdup_const+0x46/0x70
[<00000000e51fa804>] kobject_set_name_vargs+0x2f/0xb0
[<00000000247cd595>] kobject_init_and_add+0xb0/0x120
[<00000000f9139aaf>] xfs_mountfs+0x367/0xfc0
[<00000000250d3caf>] xfs_fs_fill_super+0xa16/0xdc0
[<000000008d873d38>] get_tree_bdev+0x256/0x390
[<000000004881f3fa>] vfs_get_tree+0x41/0xf0
[<000000008291ab52>] path_mount+0x9b3/0xdd0
[<0000000022ba8f2d>] __x64_sys_mount+0x190/0x1d0
As mentioned in kobject_init_and_add() comment, if this function
returns an error, kobject_put() must be called to properly clean up
the memory associated with the object. Apparently, xfs_sysfs_init()
does not follow such a requirement. When kobject_init_and_add()
returns an error, the space of kobj->kobject.name alloced by
kstrdup_const() is unfree, which will cause the above stack.
Fix it by adding kobject_put() when kobject_init_and_add returns an
error.
Fixes: a31b1d3d89 ("xfs: add xfs_mount sysfs kobject")
Signed-off-by: Li Zetao <lizetao1@huawei.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
59 lines
1.3 KiB
C
59 lines
1.3 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright (c) 2014 Red Hat, Inc.
|
|
* All Rights Reserved.
|
|
*/
|
|
|
|
#ifndef __XFS_SYSFS_H__
|
|
#define __XFS_SYSFS_H__
|
|
|
|
extern struct kobj_type xfs_mp_ktype; /* xfs_mount */
|
|
extern struct kobj_type xfs_dbg_ktype; /* debug */
|
|
extern struct kobj_type xfs_log_ktype; /* xlog */
|
|
extern struct kobj_type xfs_stats_ktype; /* stats */
|
|
|
|
static inline struct xfs_kobj *
|
|
to_kobj(struct kobject *kobject)
|
|
{
|
|
return container_of(kobject, struct xfs_kobj, kobject);
|
|
}
|
|
|
|
static inline void
|
|
xfs_sysfs_release(struct kobject *kobject)
|
|
{
|
|
struct xfs_kobj *kobj = to_kobj(kobject);
|
|
complete(&kobj->complete);
|
|
}
|
|
|
|
static inline int
|
|
xfs_sysfs_init(
|
|
struct xfs_kobj *kobj,
|
|
struct kobj_type *ktype,
|
|
struct xfs_kobj *parent_kobj,
|
|
const char *name)
|
|
{
|
|
struct kobject *parent;
|
|
int err;
|
|
|
|
parent = parent_kobj ? &parent_kobj->kobject : NULL;
|
|
init_completion(&kobj->complete);
|
|
err = kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name);
|
|
if (err)
|
|
kobject_put(&kobj->kobject);
|
|
|
|
return err;
|
|
}
|
|
|
|
static inline void
|
|
xfs_sysfs_del(
|
|
struct xfs_kobj *kobj)
|
|
{
|
|
kobject_del(&kobj->kobject);
|
|
kobject_put(&kobj->kobject);
|
|
wait_for_completion(&kobj->complete);
|
|
}
|
|
|
|
int xfs_error_sysfs_init(struct xfs_mount *mp);
|
|
void xfs_error_sysfs_del(struct xfs_mount *mp);
|
|
|
|
#endif /* __XFS_SYSFS_H__ */
|