| Message ID | 20210911085726.34778-1-cuibixuan@huawei.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [-next] scsi: bsg: Fix memory leak in bsg_register_queue() | expand |
diff --git a/block/bsg.c b/block/bsg.c index 351095193788..4d6803dad0b3 100644 --- a/block/bsg.c +++ b/block/bsg.c @@ -219,6 +219,7 @@ struct bsg_device *bsg_register_queue(struct request_queue *q, cdev_device_del(&bd->cdev, &bd->device); out_ida_remove: ida_simple_remove(&bsg_minor_ida, MINOR(bd->device.devt)); + put_device(&bd->device); out_kfree: kfree(bd); return ERR_PTR(ret);
Kmemleak tool detected a memory leak. BUG: memory leak unreferenced object 0xffff8881170da100 (size 32): comm "kworker/u4:4", pid 2996, jiffies 4294948956 (age 24.640s) hex dump (first 32 bytes): 38 3a 30 3a 30 3a 31 00 00 00 00 00 00 00 00 00 8:0:0:1......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff8147fc76>] kstrdup+0x36/0x70 mm/util.c:60 [<ffffffff8147fd03>] kstrdup_const+0x53/0x80 mm/util.c:83 [<ffffffff82293362>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48 [<ffffffff8235545b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289 [<ffffffff82652573>] dev_set_name+0x63/0x90 drivers/base/core.c:3147 [<ffffffff822547d1>] bsg_register_queue+0xe1/0x1d0 block/bsg.c:201 [<ffffffff82730abf>] scsi_sysfs_add_sdev+0x13f/0x380 drivers/scsi/scsi_sysfs.c:1376 [<ffffffff8272e309>] scsi_sysfs_add_devices drivers/scsi/scsi_scan.c:1727 [inline] [<ffffffff8272e309>] scsi_finish_async_scan drivers/scsi/scsi_scan.c:1812 [inline] [<ffffffff8272e309>] do_scan_async+0x109/0x200 drivers/scsi/scsi_scan.c:1855 [<ffffffff812752a4>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127 [<ffffffff81263d1f>] process_one_work+0x2cf/0x620 kernel/workqueue.c:2297 [<ffffffff81264629>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2444 [<ffffffff8126db28>] kthread+0x188/0x1d0 kernel/kthread.c:319 [<ffffffff8100234f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 The bsg_register_queue() use device_initialize() and dev_set_name() to registe device. That way if it fails, call put_device() to clean up correctly. Reported-by: syzbot+cfe9b7cf55bb54ed4e57@syzkaller.appspotmail.com Signed-off-by: Bixuan Cui <cuibixuan@huawei.com> --- block/bsg.c | 1 + 1 file changed, 1 insertion(+)