| Message ID | 20221115015042.3652261-1-yangyingliang@huawei.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | bc68e428d4963af0201e92159629ab96948f0893 |
| Headers | show |
| Series | [v2] scsi: target: tcm_loop: fix possible name leak in tcm_loop_setup_hba_bus() | expand |
On 11/14/22 7:50 PM, Yang Yingliang wrote: > If device_register() fails in tcm_loop_setup_hba_bus(), the name allocated > by dev_set_name() need be freed. As comment of device_register() says, it > should use put_device() to give up the reference in the error path. So fix > this by calling put_device(), then the name can be freed in kobject_cleanup(). > The 'tl_hba' will be freed in tcm_loop_release_adapter(), so it don't need > goto error label in this case. > > Fixes: 3703b2c5d041 ("[SCSI] tcm_loop: Add multi-fabric Linux/SCSI LLD fabric module") > Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> > --- > v1 -> v2: > Move put_device() in tcm_loop_setup_hba_bus(). > --- Reviewed-by: Mike Christie <michael.chritie@oracle.com>
On Tue, 15 Nov 2022 09:50:42 +0800, Yang Yingliang wrote: > If device_register() fails in tcm_loop_setup_hba_bus(), the name allocated > by dev_set_name() need be freed. As comment of device_register() says, it > should use put_device() to give up the reference in the error path. So fix > this by calling put_device(), then the name can be freed in kobject_cleanup(). > The 'tl_hba' will be freed in tcm_loop_release_adapter(), so it don't need > goto error label in this case. > > [...] Applied to 6.1/scsi-fixes, thanks! [1/1] scsi: target: tcm_loop: fix possible name leak in tcm_loop_setup_hba_bus() https://git.kernel.org/mkp/scsi/c/bc68e428d496
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c index 4407b56aa6d1..139031ccb700 100644 --- a/drivers/target/loopback/tcm_loop.c +++ b/drivers/target/loopback/tcm_loop.c @@ -397,6 +397,7 @@ static int tcm_loop_setup_hba_bus(struct tcm_loop_hba *tl_hba, int tcm_loop_host ret = device_register(&tl_hba->dev); if (ret) { pr_err("device_register() failed for tl_hba->dev: %d\n", ret); + put_device(&tl_hba->dev); return -ENODEV; } @@ -1073,7 +1074,7 @@ static struct se_wwn *tcm_loop_make_scsi_hba( */ ret = tcm_loop_setup_hba_bus(tl_hba, tcm_loop_hba_no_cnt); if (ret) - goto out; + return ERR_PTR(ret); sh = tl_hba->sh; tcm_loop_hba_no_cnt++;
If device_register() fails in tcm_loop_setup_hba_bus(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(). The 'tl_hba' will be freed in tcm_loop_release_adapter(), so it don't need goto error label in this case. Fixes: 3703b2c5d041 ("[SCSI] tcm_loop: Add multi-fabric Linux/SCSI LLD fabric module") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- v1 -> v2: Move put_device() in tcm_loop_setup_hba_bus(). --- drivers/target/loopback/tcm_loop.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)