| Message ID | 20190123092819.5020-1-yuehaibing@huawei.com |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [v3,-next] mtd: docg3: Fix a possible memory leak of mtd->name | expand |
YueHaibing <yuehaibing@huawei.com> writes: > In case DOC_CHIPID_G3, mtd->name is not freed in err handling path, > which is alloced by kasprintf(). Fix this by using devm_kasprintf(). > > Fixes: ae9d4934b2d7 ("mtd: docg3: add multiple floor support") > Signed-off-by: YueHaibing <yuehaibing@huawei.com> > --- > v3: use devm_kasprintf > --- > drivers/mtd/devices/docg3.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) Acked-by: Robert Jarzmik <robert.jarzmik@free.fr> Cheers. -- Robert
On Wed, 23 Jan 2019 17:28:19 +0800 YueHaibing <yuehaibing@huawei.com> wrote: > In case DOC_CHIPID_G3, mtd->name is not freed in err handling path, > which is alloced by kasprintf(). Fix this by using devm_kasprintf(). > > Fixes: ae9d4934b2d7 ("mtd: docg3: add multiple floor support") > Signed-off-by: YueHaibing <yuehaibing@huawei.com> > --- > v3: use devm_kasprintf > --- > drivers/mtd/devices/docg3.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c > index 4c94fc0..59ca4f5 100644 > --- a/drivers/mtd/devices/docg3.c > +++ b/drivers/mtd/devices/docg3.c > @@ -1767,8 +1767,8 @@ static int __init doc_set_driver_info(int chip_id, struct mtd_info *mtd) > > switch (chip_id) { > case DOC_CHIPID_G3: > - mtd->name = kasprintf(GFP_KERNEL, "docg3.%d", > - docg3->device_id); > + mtd->name = devm_kasprintf(docg3->dev, GFP_KERNEL, "docg3.%d", > + docg3->device_id); You forgot to remove the kfree() in the ->remove() path. > if (!mtd->name) > return -ENOMEM; > docg3->max_block = 2047;
On 2019/1/24 23:00, Boris Brezillon wrote: > On Wed, 23 Jan 2019 17:28:19 +0800 > YueHaibing <yuehaibing@huawei.com> wrote: > >> In case DOC_CHIPID_G3, mtd->name is not freed in err handling path, >> which is alloced by kasprintf(). Fix this by using devm_kasprintf(). >> >> Fixes: ae9d4934b2d7 ("mtd: docg3: add multiple floor support") >> Signed-off-by: YueHaibing <yuehaibing@huawei.com> >> --- >> v3: use devm_kasprintf >> --- >> drivers/mtd/devices/docg3.c | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c >> index 4c94fc0..59ca4f5 100644 >> --- a/drivers/mtd/devices/docg3.c >> +++ b/drivers/mtd/devices/docg3.c >> @@ -1767,8 +1767,8 @@ static int __init doc_set_driver_info(int chip_id, struct mtd_info *mtd) >> >> switch (chip_id) { >> case DOC_CHIPID_G3: >> - mtd->name = kasprintf(GFP_KERNEL, "docg3.%d", >> - docg3->device_id); >> + mtd->name = devm_kasprintf(docg3->dev, GFP_KERNEL, "docg3.%d", >> + docg3->device_id); > > You forgot to remove the kfree() in the ->remove() path. Oops..., I will fix this. Thanks a lot! > >> if (!mtd->name) >> return -ENOMEM; >> docg3->max_block = 2047; > > > . >
diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c index 4c94fc0..59ca4f5 100644 --- a/drivers/mtd/devices/docg3.c +++ b/drivers/mtd/devices/docg3.c @@ -1767,8 +1767,8 @@ static int __init doc_set_driver_info(int chip_id, struct mtd_info *mtd) switch (chip_id) { case DOC_CHIPID_G3: - mtd->name = kasprintf(GFP_KERNEL, "docg3.%d", - docg3->device_id); + mtd->name = devm_kasprintf(docg3->dev, GFP_KERNEL, "docg3.%d", + docg3->device_id); if (!mtd->name) return -ENOMEM; docg3->max_block = 2047;
In case DOC_CHIPID_G3, mtd->name is not freed in err handling path, which is alloced by kasprintf(). Fix this by using devm_kasprintf(). Fixes: ae9d4934b2d7 ("mtd: docg3: add multiple floor support") Signed-off-by: YueHaibing <yuehaibing@huawei.com> --- v3: use devm_kasprintf --- drivers/mtd/devices/docg3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)