Commit c1a752ba authored Sep 07, 2015 by Leon Yu Committed by Greg Kroah-Hartman Oct 04, 2015

tty: don't leak cdev in tty_cdev_add()



Commit a3a10ce3 ("Avoid usb reset crashes by making tty_io cdevs truly
dynamic") which mixes using cdev_alloc() and cdev_init() is problematic.
Subsequent call to cdev_init() after cdev_alloc() sets kobj release method
from cdev_dynamic_release() to cdev_default_release() and thus makes it
impossible to free allocated cdev.

This patch also consolidates error path of cdev_add() as cdev can also leak
here if things went wrong.

Signed-off-by: Leon Yu <chianglungyu@gmail.com>
Fixes: a3a10ce3 ("Avoid usb reset crashes by making tty_io cdevs truly dynamic")
Acked-by: Richard Watts <rrw@kynesim.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 0c727a42

drivers/tty/tty_io.c

+7 −2

Original line number	Diff line number	Diff line
		@@ -3151,13 +3151,18 @@ struct class *tty_class;
		static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
		unsigned int index, unsigned int count)
		{
		int err;

		/* init here, since reused cdevs cause crashes */
		driver->cdevs[index] = cdev_alloc();
		if (!driver->cdevs[index])
		return -ENOMEM;
		cdev_init(driver->cdevs[index], &tty_fops);
		driver->cdevs[index]->ops = &tty_fops;
		driver->cdevs[index]->owner = driver->owner;
		return cdev_add(driver->cdevs[index], dev, count);
		err = cdev_add(driver->cdevs[index], dev, count);
		if (err)
		kobject_put(&driver->cdevs[index]->kobj);
		return err;
		}

		/**