queue-4.4/parport-fix-mem-leak-in-parport_register_dev_model.patch

   1 From d80a49ce4e7868fadee25b3d494b96f0c2e267aa Mon Sep 17 00:00:00 2001
   2 From: YueHaibing <yuehaibing@huawei.com>
   3 Date: Tue, 14 May 2019 23:24:37 +0800
   4 Subject: parport: Fix mem leak in parport_register_dev_model
   5
   6 [ Upstream commit 1c7ebeabc9e5ee12e42075a597de40fdb9059530 ]
   7
   8 BUG: memory leak
   9 unreferenced object 0xffff8881df48cda0 (size 16):
  10   comm "syz-executor.0", pid 5077, jiffies 4295994670 (age 22.280s)
  11   hex dump (first 16 bytes):
  12     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  13   backtrace:
  14     [<00000000d2d0d5fe>] parport_register_dev_model+0x141/0x6e0 [parport]
  15     [<00000000782f6dab>] 0xffffffffc15d1196
  16     [<00000000d2ca6ae4>] platform_drv_probe+0x7e/0x100
  17     [<00000000628c2a94>] really_probe+0x342/0x4d0
  18     [<000000006874f5da>] driver_probe_device+0x8c/0x170
  19     [<00000000424de37a>] __device_attach_driver+0xda/0x100
  20     [<000000002acab09a>] bus_for_each_drv+0xfe/0x170
  21     [<000000003d9e5f31>] __device_attach+0x190/0x230
  22     [<0000000035d32f80>] bus_probe_device+0x123/0x140
  23     [<00000000a05ba627>] device_add+0x7cc/0xce0
  24     [<000000003f7560bf>] platform_device_add+0x230/0x3c0
  25     [<000000002a0be07d>] 0xffffffffc15d0949
  26     [<000000007361d8d2>] port_check+0x3b/0x50 [parport]
  27     [<000000004d67200f>] bus_for_each_dev+0x115/0x180
  28     [<000000003ccfd11c>] __parport_register_driver+0x1f0/0x210 [parport]
  29     [<00000000987f06fc>] 0xffffffffc15d803e
  30
  31 After commit 4e5a74f1db8d ("parport: Revert "parport: fix
  32 memory leak""), free_pardevice do not free par_dev->state,
  33 we should free it in error path of parport_register_dev_model
  34 before return.
  35
  36 Reported-by: Hulk Robot <hulkci@huawei.com>
  37 Fixes: 4e5a74f1db8d ("parport: Revert "parport: fix memory leak"")
  38 Signed-off-by: YueHaibing <yuehaibing@huawei.com>
  39 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  40 Signed-off-by: Sasha Levin <sashal@kernel.org>
  41 ---
  42  drivers/parport/share.c | 2 ++
  43  1 file changed, 2 insertions(+)
  44
  45 diff --git a/drivers/parport/share.c b/drivers/parport/share.c
  46 index 754f21fd9768..f26af0214ab3 100644
  47 --- a/drivers/parport/share.c
  48 +++ b/drivers/parport/share.c
  49 @@ -892,6 +892,7 @@ parport_register_dev_model(struct parport *port, const char *name,
  50         par_dev->devmodel = true;
  51         ret = device_register(&par_dev->dev);
  52         if (ret) {
  53 +               kfree(par_dev->state);
  54                 put_device(&par_dev->dev);
  55                 goto err_put_port;
  56         }
  57 @@ -909,6 +910,7 @@ parport_register_dev_model(struct parport *port, const char *name,
  58                         spin_unlock(&port->physport->pardevice_lock);
  59                         pr_debug("%s: cannot grant exclusive access for device %s\n",
  60                                  port->name, name);
  61 +                       kfree(par_dev->state);
  62                         device_unregister(&par_dev->dev);
  63                         goto err_put_port;
  64                 }
  65 --
  66 2.20.1
  67