[PATCH] cxl: Fix kobject memleak

Currently the error return path from kobject_init_and_add() is not
followed by a call to kobject_put() - which means we are leaking
the kobject.

Fix it by adding a call to kobject_put() in the error path of
kobject_init_and_add().

Fixes: b087e6190ddc ("cxl: Export optional AFU configuration record in sysfs")
Reported-by: Hulk Robot <redacted>
Signed-off-by: Wang Hai <redacted>
---
 drivers/misc/cxl/sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
index f0263d1..d97a243 100644
--- a/drivers/misc/cxl/sysfs.c
+++ b/drivers/misc/cxl/sysfs.c

@@ -624,7 +624,7 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c
 	rc = kobject_init_and_add(&cr->kobj, &afu_config_record_type,
 				  &afu->dev.kobj, "cr%i", cr->cr);
 	if (rc)
-		goto err;
+		goto err1;
 
 	rc = sysfs_create_bin_file(&cr->kobj, &cr->config_attr);
 	if (rc)

-- 
1.8.3.1

Le 02/06/2020 à 14:07, Wang Hai a écrit :

Currently the error return path from kobject_init_and_add() is not
followed by a call to kobject_put() - which means we are leaking
the kobject.

Fix it by adding a call to kobject_put() in the error path of
kobject_init_and_add().

Fixes: b087e6190ddc ("cxl: Export optional AFU configuration record in sysfs")
Reported-by: Hulk Robot <redacted>
Signed-off-by: Wang Hai <redacted>

Indeed, a call to kobject_put() is needed when the init fails.
Thanks!
Acked-by: Frederic Barrat <redacted>

On 2/6/20 10:07 pm, Wang Hai wrote:

Currently the error return path from kobject_init_and_add() is not
followed by a call to kobject_put() - which means we are leaking
the kobject.

Fix it by adding a call to kobject_put() in the error path of
kobject_init_and_add().

Fixes: b087e6190ddc ("cxl: Export optional AFU configuration record in sysfs")
Reported-by: Hulk Robot <redacted>
Signed-off-by: Wang Hai <redacted>

Thanks for the fix!

I note that the err1 label returns without calling kfree(cr) and I can't 
see a reason why we do that - so perhaps we should remove the return 
statement in err1: so it falls through?

-- 
Andrew Donnellan              OzLabs, ADL Canberra
ajd@linux.ibm.com             IBM Australia Limited

在 2020/6/3 19:33, Andrew Donnellan 写道:

On 2/6/20 10:07 pm, Wang Hai wrote:

quoted

Currently the error return path from kobject_init_and_add() is not
followed by a call to kobject_put() - which means we are leaking
the kobject.

Fix it by adding a call to kobject_put() in the error path of
kobject_init_and_add().

Fixes: b087e6190ddc ("cxl: Export optional AFU configuration record 
in sysfs")
Reported-by: Hulk Robot <redacted>
Signed-off-by: Wang Hai <redacted>

Thanks for the fix!

I note that the err1 label returns without calling kfree(cr) and I 
can't see a reason why we do that - so perhaps we should remove the 
return statement in err1: so it falls through?

kfree(cr) can be called when 
kobject_put()-->kobject_release()-->kobject_cleanup()-->kobj_type->release() 
is called.  The kobj_type here is afu_config_record_type


Thanks,

Wang Hai

On 3/6/20 9:57 pm, wanghai (M) wrote:

kfree(cr) can be called when 
kobject_put()-->kobject_release()-->kobject_cleanup()-->kobj_type->release() 
is called.  The kobj_type here is afu_config_record_type

Of course, I missed that.

In that case

Acked-by: Andrew Donnellan <redacted>

Thanks for the fix!

-- 
Andrew Donnellan              OzLabs, ADL Canberra
ajd@linux.ibm.com             IBM Australia Limited