pstore/ram: Fix failure-path memory leak in ramoops_init (bac6f6cd) · Commits · 戴 / test

As reported by nixiaoming, with some minor clarifications: 1) memory leak in ramoops_register_dummy(): dummy_data = kzalloc(sizeof(*dummy_data), GFP_KERNEL); but no kfree() if platform_device_register_data() fails. 2) memory leak in ramoops_init(): Missing platform_device_unregister(dummy) and kfree(dummy_data) if platform_driver_register(&ramoops_driver) fails. I've clarified the purpose of ramoops_register_dummy(), and added a common cleanup routine for all three failure paths to call. Reported-by:

nixiaoming <nixiaoming@huawei.com> Cc: stable@vger.kernel.org Cc: Anton Vorontsov <anton@enomsg.org> Cc: Colin Cross <ccross@android.com> Cc: Tony Luck <tony.luck@intel.com> Cc: Joel Fernandes <joelaf@google.com> Cc: Geliang Tang <geliangtang@gmail.com> Signed-off-by:

Kees Cook <keescook@chromium.org>

fs/pstore/ram.c

+25 −4

Original line number	Diff line number	Diff line
		@@ -898,8 +898,22 @@ static struct platform_driver ramoops_driver = {
		},
		};

		static void ramoops_register_dummy(void)
		static inline void ramoops_unregister_dummy(void)
		{
		platform_device_unregister(dummy);
		dummy = NULL;

		kfree(dummy_data);
		dummy_data = NULL;
		}

		static void __init ramoops_register_dummy(void)
		{
		/*
		* Prepare a dummy platform data structure to carry the module
		* parameters. If mem_size isn't set, then there are no module
		* parameters, and we can skip this.
		*/
		if (!mem_size)
		return;

		@@ -932,21 +946,28 @@ static void ramoops_register_dummy(void)
		if (IS_ERR(dummy)) {
		pr_info("could not create platform device: %ld\n",
		PTR_ERR(dummy));
		dummy = NULL;
		ramoops_unregister_dummy();
		}
		}

		static int __init ramoops_init(void)
		{
		int ret;

		ramoops_register_dummy();
		return platform_driver_register(&ramoops_driver);
		ret = platform_driver_register(&ramoops_driver);
		if (ret != 0)
		ramoops_unregister_dummy();

		return ret;
		}
		late_initcall(ramoops_init);

		static void __exit ramoops_exit(void)
		{
		platform_driver_unregister(&ramoops_driver);
		platform_device_unregister(dummy);
		kfree(dummy_data);
		ramoops_unregister_dummy();
		}
		module_exit(ramoops_exit);

Admin message