releases/5.1.3/bridge-fix-error-path-for-kobject_init_and_add.patch

   1 From foo@baz Wed 15 May 2019 07:51:30 AM CEST
   2 From: "Tobin C. Harding" <tobin@kernel.org>
   3 Date: Fri, 10 May 2019 12:52:12 +1000
   4 Subject: bridge: Fix error path for kobject_init_and_add()
   5
   6 From: "Tobin C. Harding" <tobin@kernel.org>
   7
   8 [ Upstream commit bdfad5aec1392b93495b77b864d58d7f101dc1c1 ]
   9
  10 Currently error return from kobject_init_and_add() is not followed by a
  11 call to kobject_put().  This means there is a memory leak.  We currently
  12 set p to NULL so that kfree() may be called on it as a noop, the code is
  13 arguably clearer if we move the kfree() up closer to where it is
  14 called (instead of after goto jump).
  15
  16 Remove a goto label 'err1' and jump to call to kobject_put() in error
  17 return from kobject_init_and_add() fixing the memory leak.  Re-name goto
  18 label 'put_back' to 'err1' now that we don't use err1, following current
  19 nomenclature (err1, err2 ...).  Move call to kfree out of the error
  20 code at bottom of function up to closer to where memory was allocated.
  21 Add comment to clarify call to kfree().
  22
  23 Signed-off-by: Tobin C. Harding <tobin@kernel.org>
  24 Signed-off-by: David S. Miller <davem@davemloft.net>
  25 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  26 ---
  27  net/bridge/br_if.c |   13 ++++++-------
  28  1 file changed, 6 insertions(+), 7 deletions(-)
  29
  30 --- a/net/bridge/br_if.c
  31 +++ b/net/bridge/br_if.c
  32 @@ -602,13 +602,15 @@ int br_add_if(struct net_bridge *br, str
  33         call_netdevice_notifiers(NETDEV_JOIN, dev);
  34
  35         err = dev_set_allmulti(dev, 1);
  36 -       if (err)
  37 -               goto put_back;
  38 +       if (err) {
  39 +               kfree(p);       /* kobject not yet init'd, manually free */
  40 +               goto err1;
  41 +       }
  42
  43         err = kobject_init_and_add(&p->kobj, &brport_ktype, &(dev->dev.kobj),
  44                                    SYSFS_BRIDGE_PORT_ATTR);
  45         if (err)
  46 -               goto err1;
  47 +               goto err2;
  48
  49         err = br_sysfs_addif(p);
  50         if (err)
  51 @@ -700,12 +702,9 @@ err3:
  52         sysfs_remove_link(br->ifobj, p->dev->name);
  53  err2:
  54         kobject_put(&p->kobj);
  55 -       p = NULL; /* kobject_put frees */
  56 -err1:
  57         dev_set_allmulti(dev, -1);
  58 -put_back:
  59 +err1:
  60         dev_put(dev);
  61 -       kfree(p);
  62         return err;
  63  }
  64