| Message ID | 20231130021350.2733064-1-yangyingliang@huaweicloud.com |
|---|---|
| State | New |
| Headers | show |
| Series | NTB: fix possible name leak in ntb_register_device() | expand |
On Thu, Nov 30, 2023 at 10:13:50AM +0800, Yang Yingliang wrote: > From: Yang Yingliang <yangyingliang@huawei.com> > > If device_register() returns error in ntb_register_device(), > the name allocated by dev_set_name() need be freed. As comment > of device_register() says, it should use put_device() to give > up the reference in the error path. So fix this by calling > put_device(), then the name can be freed in kobject_cleanup(). > > Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer") > Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> > --- > drivers/ntb/core.c | 8 +++++++- > drivers/pci/endpoint/functions/pci-epf-vntb.c | 6 +----- > 2 files changed, 8 insertions(+), 6 deletions(-) > > diff --git a/drivers/ntb/core.c b/drivers/ntb/core.c > index 27dd93deff6e..d702bee78082 100644 > --- a/drivers/ntb/core.c > +++ b/drivers/ntb/core.c > @@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client); > > int ntb_register_device(struct ntb_dev *ntb) > { > + int ret; > + > if (!ntb) > return -EINVAL; > if (!ntb->pdev) > @@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb) > ntb->ctx_ops = NULL; > spin_lock_init(&ntb->ctx_lock); > > - return device_register(&ntb->dev); > + ret = device_register(&ntb->dev); > + if (ret) > + put_device(&ntb->dev); > + > + return ret; > } > EXPORT_SYMBOL(ntb_register_device); > > diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c > index 3f60128560ed..8e4ed188ad5c 100644 > --- a/drivers/pci/endpoint/functions/pci-epf-vntb.c > +++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c > @@ -1278,15 +1278,11 @@ static int pci_vntb_probe(struct pci_dev *pdev, const struct pci_device_id *id) > ret = ntb_register_device(&ndev->ntb); > if (ret) { > dev_err(dev, "Failed to register NTB device\n"); > - goto err_register_dev; > + return -EINVAL; Even though this is the existing behavior, you should return ret. - Mani > } > > dev_dbg(dev, "PCI Virtual NTB driver loaded\n"); > return 0; > - > -err_register_dev: > - put_device(&ndev->ntb.dev); > - return -EINVAL; > } > > static struct pci_device_id pci_vntb_table[] = { > -- > 2.25.1 >
diff --git a/drivers/ntb/core.c b/drivers/ntb/core.c index 27dd93deff6e..d702bee78082 100644 --- a/drivers/ntb/core.c +++ b/drivers/ntb/core.c @@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client); int ntb_register_device(struct ntb_dev *ntb) { + int ret; + if (!ntb) return -EINVAL; if (!ntb->pdev) @@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb) ntb->ctx_ops = NULL; spin_lock_init(&ntb->ctx_lock); - return device_register(&ntb->dev); + ret = device_register(&ntb->dev); + if (ret) + put_device(&ntb->dev); + + return ret; } EXPORT_SYMBOL(ntb_register_device); diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c index 3f60128560ed..8e4ed188ad5c 100644 --- a/drivers/pci/endpoint/functions/pci-epf-vntb.c +++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c @@ -1278,15 +1278,11 @@ static int pci_vntb_probe(struct pci_dev *pdev, const struct pci_device_id *id) ret = ntb_register_device(&ndev->ntb); if (ret) { dev_err(dev, "Failed to register NTB device\n"); - goto err_register_dev; + return -EINVAL; } dev_dbg(dev, "PCI Virtual NTB driver loaded\n"); return 0; - -err_register_dev: - put_device(&ndev->ntb.dev); - return -EINVAL; } static struct pci_device_id pci_vntb_table[] = {