Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bac6f6cd authored by Kees Cook's avatar Kees Cook
Browse files

pstore/ram: Fix failure-path memory leak in ramoops_init 



As reported by nixiaoming, with some minor clarifications:

1) memory leak in ramoops_register_dummy():
   dummy_data = kzalloc(sizeof(*dummy_data), GFP_KERNEL);
   but no kfree() if platform_device_register_data() fails.

2) memory leak in ramoops_init():
   Missing platform_device_unregister(dummy) and kfree(dummy_data)
   if platform_driver_register(&ramoops_driver) fails.

I've clarified the purpose of ramoops_register_dummy(), and added a
common cleanup routine for all three failure paths to call.

Reported-by: default avatarnixiaoming <nixiaoming@huawei.com>
Cc: stable@vger.kernel.org
Cc: Anton Vorontsov <anton@enomsg.org>
Cc: Colin Cross <ccross@android.com>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Joel Fernandes <joelaf@google.com>
Cc: Geliang Tang <geliangtang@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 831b624d

fs/pstore/ram.c

+25 −4
Original line number Diff line number Diff line
@@ -898,8 +898,22 @@ static struct platform_driver ramoops_driver = { 
	},

};



static void ramoops_register_dummy(void)

static inline void ramoops_unregister_dummy(void)

{

	platform_device_unregister(dummy);

	dummy = NULL;



	kfree(dummy_data);

	dummy_data = NULL;

}



static void __init ramoops_register_dummy(void)

{

	/*

	 * Prepare a dummy platform data structure to carry the module

	 * parameters. If mem_size isn't set, then there are no module

	 * parameters, and we can skip this.

	 */

	if (!mem_size)

		return;
@@ -932,21 +946,28 @@ static void ramoops_register_dummy(void) 
	if (IS_ERR(dummy)) {

		pr_info("could not create platform device: %ld\n",

			PTR_ERR(dummy));

		dummy = NULL;

		ramoops_unregister_dummy();

	}

}



static int __init ramoops_init(void)

{

	int ret;



	ramoops_register_dummy();

	return platform_driver_register(&ramoops_driver);

	ret = platform_driver_register(&ramoops_driver);

	if (ret != 0)

		ramoops_unregister_dummy();



	return ret;

}

late_initcall(ramoops_init);



static void __exit ramoops_exit(void)

{

	platform_driver_unregister(&ramoops_driver);

	platform_device_unregister(dummy);

	kfree(dummy_data);

	ramoops_unregister_dummy();

}

module_exit(ramoops_exit);