Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1220160 > unrolled thread

[PATCH] tty: don't leak cdev in tty_cdev_add()

Back to article view | Back to linux.kernel

Contents

  [PATCH] tty: don't leak cdev in tty_cdev_add() Leon Yu <chianglungyu@gmail.com> - 2015-09-07 15:10 +0200
    Re: [PATCH] tty: don't leak cdev in tty_cdev_add() Richard Watts <rrw@kynesim.co.uk> - 2015-09-08 12:50 +0200

#1220160 — [PATCH] tty: don't leak cdev in tty_cdev_add()

Commit a3a10ce3429e ("Avoid usb reset crashes by making tty_io cdevs truly
dynamic") which mixes using cdev_alloc() and cdev_init() is problematic.
Subsequent call to cdev_init() after cdev_alloc() sets kobj release method
from cdev_dynamic_release() to cdev_default_release() and thus makes it
impossible to free allocated cdev.

This patch also consolidates error path of cdev_add() as cdev can also leak
here if things went wrong.

Signed-off-by: Leon Yu <chianglungyu@gmail.com>
Fixes: a3a10ce3429e ("Avoid usb reset crashes by making tty_io cdevs truly dynamic")
---
 drivers/tty/tty_io.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 02785d8..17b0272 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -3151,13 +3151,18 @@ struct class *tty_class;
 static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
 		unsigned int index, unsigned int count)
 {
+	int err;
+
 	/* init here, since reused cdevs cause crashes */
 	driver->cdevs[index] = cdev_alloc();
 	if (!driver->cdevs[index])
 		return -ENOMEM;
-	cdev_init(driver->cdevs[index], &tty_fops);
+	driver->cdevs[index]->ops = &tty_fops;
 	driver->cdevs[index]->owner = driver->owner;
-	return cdev_add(driver->cdevs[index], dev, count);
+	err = cdev_add(driver->cdevs[index], dev, count);
+	if (err)
+		kobject_put(&driver->cdevs[index]->kobj);
+	return err;
 }
 
 /**
-- 
2.5.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1220692

On 07/09/15 14:08, Leon Yu wrote:
> Commit a3a10ce3429e ("Avoid usb reset crashes by making tty_io cdevs truly
> dynamic") which mixes using cdev_alloc() and cdev_init() is problematic.
> Subsequent call to cdev_init() after cdev_alloc() sets kobj release method
> from cdev_dynamic_release() to cdev_default_release() and thus makes it
> impossible to free allocated cdev.
>
> This patch also consolidates error path of cdev_add() as cdev can also leak
> here if things went wrong.
>
> Signed-off-by: Leon Yu <chianglungyu@gmail.com>
> Fixes: a3a10ce3429e ("Avoid usb reset crashes by making tty_io cdevs truly dynamic")

  Oops! Apologies. Looks good to me - thank you.

Acked-by: Richard Watts <rrw@kynesim.co.uk>



Richard.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web