blk-mq: Fix refcounting leak in __blk_mq_register_dev()
Subsystems (2)
PATCH 1/1 blk-mq: Fix refcounting leak in __blk_mq_register_dev()
There is a kobject_add() hidden in the call to kobject_add().
ret = kobject_add(q->mq_kobj, kobject_get(&dev->kobj), "%s", "mq");
^^^^^^^^^^^^^^^^^^^^^^^It needs to be release on the error path.
Fixes 320ae51feed5 ("blk-mq: new multi-queue block IO queueing mechanism")
Signed-off-by Dan Carpenter <[email protected]>
--- block/blk-mq-sysfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
block/blk-mq-sysfs.c +3 -3
@@ -321,7 +321,7 @@ int __blk_mq_register_dev(struct device *dev, struct request_queue *q) ret =kobject_add (q->mq_kobj,kobject_get (&dev->kobj),"%s" ,"mq" );if (ret <0 ) - goto out; + goto out_kobj;kobject_uevent (q->mq_kobj,KOBJ_ADD );
@@ -333,8 +333,7 @@ int __blk_mq_register_dev(struct device *dev, struct request_queue *q) q->mq_sysfs_init_done = true; -out: -return ret; +return 0 ; unreg:while (--i >=0 )
@@ -342,6 +341,7 @@ int __blk_mq_register_dev(struct device *dev, struct request_queue *q)kobject_uevent (q->mq_kobj,KOBJ_REMOVE );kobject_del (q->mq_kobj); +out_kobj:kobject_put (&dev->kobj);return ret; }
Signature · 1 line
2.28.0
Quoted 47 lines · Dan Carpenter
There is a
kobject_add()hidden in the call tokobject_add().ret = kobject_add(q->mq_kobj, kobject_get(&dev->kobj), "%s", "mq"); ^^^^^^^^^^^^^^^^^^^^^^^It needs to be release on the error path.
Fixes 320ae51feed5 ("blk-mq: new multi-queue block IO queueing mechanism")Signed-off-by Dan Carpenter <[email protected]>--- block/blk-mq-sysfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)block/blk-mq-sysfs.c +3
-3@@ -321,7 +321,7 @@ int __blk_mq_register_dev(struct device *dev, struct request_queue *q) ret =kobject_add (q->mq_kobj,kobject_get (&dev->kobj),"%s" ,"mq" );if (ret <0 ) - goto out; + goto out_kobj;kobject_uevent (q->mq_kobj,KOBJ_ADD );@@ -333,8 +333,7 @@ int __blk_mq_register_dev(struct device *dev, struct request_queue *q) q->mq_sysfs_init_done = true; -out: -return ret; +return 0 ; unreg:while (--i >=0 )@@ -342,6 +341,7 @@ int __blk_mq_register_dev(struct device *dev, struct request_queue *q)kobject_uevent (q->mq_kobj,KOBJ_REMOVE );kobject_del (q->mq_kobj); +out_kobj:kobject_put (&dev->kobj);return ret; }Signature · 1 line
2.28.0
Looks good fix:
Reviewed-by Ming Lei <[email protected]>
Signature · 1 line
Ming