From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Qiushi Wu <wu000273@umn.edu>,
"Rafael J . Wysocki" <rafael.j.wysocki@intel.com>,
Sasha Levin <sashal@kernel.org>,
linux-pm@vger.kernel.org
Subject: [PATCH AUTOSEL 4.4 36/37] cpuidle: Fix three reference count leaks
Date: Mon, 8 Jun 2020 19:27:48 -0400 [thread overview]
Message-ID: <20200608232750.3370747-36-sashal@kernel.org> (raw)
In-Reply-To: <20200608232750.3370747-1-sashal@kernel.org>
From: Qiushi Wu <wu000273@umn.edu>
[ Upstream commit c343bf1ba5efcbf2266a1fe3baefec9cc82f867f ]
kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.
Previous commit "b8eb718348b8" fixed a similar problem.
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
[ rjw: Subject ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpuidle/sysfs.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index 9e98a5fbbc1d..e7e92ed34f0c 100644
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -412,7 +412,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device)
ret = kobject_init_and_add(&kobj->kobj, &ktype_state_cpuidle,
&kdev->kobj, "state%d", i);
if (ret) {
- kfree(kobj);
+ kobject_put(&kobj->kobj);
goto error_state;
}
kobject_uevent(&kobj->kobj, KOBJ_ADD);
@@ -542,7 +542,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev)
ret = kobject_init_and_add(&kdrv->kobj, &ktype_driver_cpuidle,
&kdev->kobj, "driver");
if (ret) {
- kfree(kdrv);
+ kobject_put(&kdrv->kobj);
return ret;
}
@@ -636,7 +636,7 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
error = kobject_init_and_add(&kdev->kobj, &ktype_cpuidle, &cpu_dev->kobj,
"cpuidle");
if (error) {
- kfree(kdev);
+ kobject_put(&kdev->kobj);
return error;
}
--
2.25.1
next prev parent reply other threads:[~2020-06-08 23:35 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-08 23:27 [PATCH AUTOSEL 4.4 01/37] ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 02/37] ath9k: Fix use-after-free Write in ath9k_htc_rx_msg Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 03/37] spi: dw: Zero DMA Tx and Rx configurations on stack Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 04/37] Bluetooth: Add SCO fallback for invalid LMP parameters error Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 05/37] kgdb: Prevent infinite recursive entries to the debugger Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 06/37] spi: dw: Enable interrupts in accordance with DMA xfer mode Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 07/37] clocksource: dw_apb_timer_of: Fix missing clockevent timers Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 08/37] btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 09/37] ARM: 8978/1: mm: make act_mm() respect THREAD_SIZE Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 10/37] net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss() Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 11/37] staging: android: ion: use vmap instead of vm_map_ram Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 12/37] ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 13/37] ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 14/37] e1000: Distribute switch variables for initialization Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 15/37] media: dvb: return -EREMOTEIO on i2c transfer failure Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 16/37] MIPS: Make sparse_init() using top-down allocation Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 17/37] netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 18/37] lib/mpi: Fix 64-bit MIPS build with Clang Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 19/37] net: lpc-enet: fix error return code in lpc_mii_init() Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 20/37] net: allwinner: Fix use correct return type for ndo_start_xmit() Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 21/37] powerpc/spufs: fix copy_to_user while atomic Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 22/37] ath9k_htc: Silence undersized packet warnings Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 23/37] mips: cm: Fix an invalid error code of INTVN_*_ERR Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 24/37] kgdb: Fix spurious true from in_dbg_master() Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 25/37] md: don't flush workqueue unconditionally in md_open Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 26/37] mwifiex: Fix memory corruption in dump_station Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 27/37] mips: Add udelay lpj numbers adjustment Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 28/37] x86/mm: Stop printing BRK addresses Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 29/37] m68k: mac: Don't call via_flush_cache() on Mac IIfx Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 30/37] macvlan: Skip loopback packets in RX handler Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 31/37] PCI: Don't disable decoding when mmio_always_on is set Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 32/37] MIPS: Fix IRQ tracing when call handle_fpe() and handle_msa_fpe() Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 33/37] xfs: gut error handling in xfs_trans_unreserve_and_mod_sb() Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 34/37] ixgbe: fix signed-integer-overflow warning Sasha Levin
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 35/37] spi: dw: Return any value retrieved from the dma_transfer callback Sasha Levin
2020-06-08 23:27 ` Sasha Levin [this message]
2020-06-08 23:27 ` [PATCH AUTOSEL 4.4 37/37] vxlan: Avoid infinite loop when suppressing NS messages with invalid options Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200608232750.3370747-36-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=rafael.j.wysocki@intel.com \
--cc=stable@vger.kernel.org \
--cc=wu000273@umn.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox