| Message ID | 20221105092923.2844847-1-yangyingliang@huawei.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [v2] dmaengine: fix possible memory leak in while registering device channel | expand |
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index c741b6431958..46adfec04f0c 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -1068,8 +1068,11 @@ static int __dma_async_device_channel_register(struct dma_device *device, dev_set_name(&chan->dev->device, "dma%dchan%d", device->dev_id, chan->chan_id); rc = device_register(&chan->dev->device); - if (rc) + if (rc) { + put_device(&chan->dev->device); + chan->dev = NULL; goto err_out_ida; + } chan->client_count = 0; device->chancnt++;
If device_register() returns error, the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(), the dma_chan_dev will be freed in chan_dev_release(), set 'chan->dev' to null in the error path to avoid it be freed again by kfree(). Fixes: d2fb0a043838 ("dmaengine: break out channel registration") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- v1 -> v2: Add fix tag and update commit message. --- drivers/dma/dmaengine.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)