thermal/of: Fix memory leak on thermal_of_zone_register() failure

PATCH Applied Ido Schimmel 3 participants 3 messages Oct 20, 2022 – Dec 9, 2022 Thermal

lore

Share & tools

lore

Ido Schimmel

author

2022-10-20 10:37 UTC #0 lore raw

PATCH 1/1 thermal/of: Fix memory leak on thermal_of_zone_register() failure

The function does not free 'of_ops' upon failure, leading to a memory leak [1].

Fix by freeing 'of_ops' in the error path.

[1]
unreferenced object 0xffff8ee846198c80 (size 128):
comm "swapper/0", pid 1, jiffies 4294699704 (age 70.076s) hex dump (first 32 bytes):

    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    d0 3f 6e 8c ff ff ff ff 00 00 00 00 00 00 00 00  .?n.............
  backtrace:
    [<00000000d136f562>] __kmalloc_node_track_caller+0x42/0x120
    [<0000000063f31678>] kmemdup+0x1d/0x40
    [<00000000e6d24096>] thermal_of_zone_register+0x49/0x520
    [<000000005e78c755>] devm_thermal_of_zone_register+0x54/0x90
    [<00000000ee6b209e>] pmbus_add_sensor+0x1b4/0x1d0
    [<00000000896105e3>] pmbus_add_sensor_attrs_one+0x123/0x440
    [<0000000049e990a6>] pmbus_add_sensor_attrs+0xfe/0x1d0
    [<00000000466b5440>] pmbus_do_probe+0x66b/0x14e0
    [<0000000084d42285>] i2c_device_probe+0x13b/0x2f0
    [<0000000029e2ae74>] really_probe+0xce/0x2c0
    [<00000000692df15c>] driver_probe_device+0x19/0xd0
    [<00000000547d9cce>] __device_attach_driver+0x6f/0x100
    [<0000000020abd24b>] bus_for_each_drv+0x76/0xc0
    [<00000000665d9563>] __device_attach+0xfc/0x180
    [<000000008ddd4d6a>] bus_probe_device+0x82/0xa0
    [<000000009e61132b>] device_add+0x3fe/0x920

Fixes 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization")

Signed-off-by Ido Schimmel <[email protected]>

Reviewed-by Vadim Pasternak <[email protected]>

---
 drivers/thermal/thermal_of.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

drivers/thermal/thermal_of.c +6 -2

index d4b6335ace15..aacba30bc10c 100644
@@ -604,13 +604,15 @@ struct thermal_zone_device *thermal_of_zone_register(struct device_node *sensor,
 	if (IS_ERR(np)) {
 		if (PTR_ERR(np) != -ENODEV)
 			pr_err("Failed to find thermal zone for %pOFn id=%d\n", sensor, id);
-		return ERR_CAST(np);
+		ret = PTR_ERR(np);
+		goto out_kfree_of_ops;
 	}
 
 	trips = thermal_of_trips_init(np, &ntrips);
 	if (IS_ERR(trips)) {
 		pr_err("Failed to find trip points for %pOFn id=%d\n", sensor, id);
-		return ERR_CAST(trips);
+		ret = PTR_ERR(trips);
+		goto out_kfree_of_ops;
 	}
 
 	ret = thermal_of_monitor_init(np, &delay, &pdelay);

@@ -659,6 +661,8 @@ struct thermal_zone_device *thermal_of_zone_register(struct device_node *sensor,
 	kfree(tzp);
 out_kfree_trips:
 	kfree(trips);
+out_kfree_of_ops:
+	kfree(of_ops);
 
 	return ERR_PTR(ret);
 }

Signature · 1 line

2.37.3

Daniel Lezcano

Applied

2022-10-21 10:51 UTC #1 lore raw

Quoted 29 lines · Ido Schimmel

The function does not free 'of_ops' upon failure, leading to a memory leak [1].

Fix by freeing 'of_ops' in the error path.

[1]
unreferenced object 0xffff8ee846198c80 (size 128):

   comm "swapper/0", pid 1, jiffies 4294699704 (age 70.076s)
   hex dump (first 32 bytes):
     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
     d0 3f 6e 8c ff ff ff ff 00 00 00 00 00 00 00 00  .?n.............
   backtrace:
     [<00000000d136f562>] __kmalloc_node_track_caller+0x42/0x120
     [<0000000063f31678>] kmemdup+0x1d/0x40
     [<00000000e6d24096>] thermal_of_zone_register+0x49/0x520
     [<000000005e78c755>] devm_thermal_of_zone_register+0x54/0x90
     [<00000000ee6b209e>] pmbus_add_sensor+0x1b4/0x1d0
     [<00000000896105e3>] pmbus_add_sensor_attrs_one+0x123/0x440
     [<0000000049e990a6>] pmbus_add_sensor_attrs+0xfe/0x1d0
     [<00000000466b5440>] pmbus_do_probe+0x66b/0x14e0
     [<0000000084d42285>] i2c_device_probe+0x13b/0x2f0
     [<0000000029e2ae74>] really_probe+0xce/0x2c0
     [<00000000692df15c>] driver_probe_device+0x19/0xd0
     [<00000000547d9cce>] __device_attach_driver+0x6f/0x100
     [<0000000020abd24b>] bus_for_each_drv+0x76/0xc0
     [<00000000665d9563>] __device_attach+0xfc/0x180
     [<000000008ddd4d6a>] bus_probe_device+0x82/0xa0
     [<000000009e61132b>] device_add+0x3fe/0x920

Quoted 3 lines

Fixes 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization")
Signed-off-by Ido Schimmel <[email protected]>
Reviewed-by Vadim Pasternak <[email protected]>

Applied, thanks

Signature · 5 lines

<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro:  <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog

thermal-bot for Ido Schimmel

merge bot Applied

2022-12-09 15:27 UTC #2 lore raw

In reply to Ido Schimmel

The following commit has been merged into the thermal/next branch of thermal:

Commit-ID:     35deafe88f5a5f509f87960a9fe726acc1fe9506
Gitweb:        https://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux.git//35deafe88f5a5f509f87960a9fe726acc1fe9506
Author:        Ido Schimmel <[email protected]>
AuthorDate:    Thu, 20 Oct 2022 13:36:58 +03:00
Committer:     Daniel Lezcano <[email protected]>
CommitterDate: Thu, 08 Dec 2022 14:30:43 +01:00

thermal/of: Fix memory leak on thermal_of_zone_register() failure

The function does not free 'of_ops' upon failure, leading to a memory leak [1].

Fix by freeing 'of_ops' in the error path.

[1]
unreferenced object 0xffff8ee846198c80 (size 128):
comm "swapper/0", pid 1, jiffies 4294699704 (age 70.076s) hex dump (first 32 bytes):

    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    d0 3f 6e 8c ff ff ff ff 00 00 00 00 00 00 00 00  .?n.............
  backtrace:
    [<00000000d136f562>] __kmalloc_node_track_caller+0x42/0x120
    [<0000000063f31678>] kmemdup+0x1d/0x40
    [<00000000e6d24096>] thermal_of_zone_register+0x49/0x520
    [<000000005e78c755>] devm_thermal_of_zone_register+0x54/0x90
    [<00000000ee6b209e>] pmbus_add_sensor+0x1b4/0x1d0
    [<00000000896105e3>] pmbus_add_sensor_attrs_one+0x123/0x440
    [<0000000049e990a6>] pmbus_add_sensor_attrs+0xfe/0x1d0
    [<00000000466b5440>] pmbus_do_probe+0x66b/0x14e0
    [<0000000084d42285>] i2c_device_probe+0x13b/0x2f0
    [<0000000029e2ae74>] really_probe+0xce/0x2c0
    [<00000000692df15c>] driver_probe_device+0x19/0xd0
    [<00000000547d9cce>] __device_attach_driver+0x6f/0x100
    [<0000000020abd24b>] bus_for_each_drv+0x76/0xc0
    [<00000000665d9563>] __device_attach+0xfc/0x180
    [<000000008ddd4d6a>] bus_probe_device+0x82/0xa0
    [<000000009e61132b>] device_add+0x3fe/0x920

Fixes 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization")

Signed-off-by Ido Schimmel <[email protected]>

Reviewed-by Vadim Pasternak <[email protected]>

Link https://lore.kernel.org/r/[email protected] open here

Signed-off-by Daniel Lezcano <[email protected]>

---
 drivers/thermal/thermal_of.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

drivers/thermal/thermal_of.c +6 -2

index bd87218..ff4d12e 100644
@@ -493,13 +493,15 @@ struct thermal_zone_device *thermal_of_zone_register(struct device_node *sensor,
 	if (IS_ERR(np)) {
 		if (PTR_ERR(np) != -ENODEV)
 			pr_err("Failed to find thermal zone for %pOFn id=%d\n", sensor, id);
-		return ERR_CAST(np);
+		ret = PTR_ERR(np);
+		goto out_kfree_of_ops;
 	}
 
 	trips = thermal_of_trips_init(np, &ntrips);
 	if (IS_ERR(trips)) {
 		pr_err("Failed to find trip points for %pOFn id=%d\n", sensor, id);
-		return ERR_CAST(trips);
+		ret = PTR_ERR(trips);
+		goto out_kfree_of_ops;
 	}
 
 	ret = thermal_of_monitor_init(np, &delay, &pdelay);

@@ -543,6 +545,8 @@ out_kfree_tzp:
 	kfree(tzp);
 out_kfree_trips:
 	kfree(trips);
+out_kfree_of_ops:
+	kfree(of_ops);
 
 	return ERR_PTR(ret);
 }