From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 06390C04E53 for ; Wed, 15 May 2019 12:18:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id BC8A7206BF for ; Wed, 15 May 2019 12:18:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1557922729; bh=YkaUSEF3X+pQvSn/4Ovd7ULUk+pez2JqR3/Py6kNyGM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=IWOrIDZwkBxsHoOGjtYYRMx5+Ex17tV3L+iAJYh97ZvwbYXTBlIQFxGyktDXuQ9UT 2w+XcugNQif6oJx1/UlXdfjxGIT757Nn7002uFBENQVV1zAnjQ+eZWIvkoJqij5DLj fQ4w5sBOrjDiUU7a4PjHQadDHNdeBak26ET0g570= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727614AbfEOLBE (ORCPT ); Wed, 15 May 2019 07:01:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:58040 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727612AbfEOLBE (ORCPT ); Wed, 15 May 2019 07:01:04 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1B14E20881; Wed, 15 May 2019 11:01:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1557918063; bh=YkaUSEF3X+pQvSn/4Ovd7ULUk+pez2JqR3/Py6kNyGM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ul6+ij6uVedL29qPAF0jWnqW6ANcKe1ttNKHeqzA0Kz62AUOrAOWqgYVdBWCR67Yh HhOV/v8P9749ek3MD7YGc9Jm4uYyyoJZBW9zvk8oCDTTeT7A1M5H+q6mZ09oqrc/mB OjO0iA/+jJzaltukoPtLGJu2dXbWWkMEhrg8OkEE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Tobin C. Harding" , "David S. Miller" Subject: [PATCH 3.18 78/86] bridge: Fix error path for kobject_init_and_add() Date: Wed, 15 May 2019 12:55:55 +0200 Message-Id: <20190515090655.622147146@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190515090642.339346723@linuxfoundation.org> References: <20190515090642.339346723@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: "Tobin C. Harding" [ Upstream commit bdfad5aec1392b93495b77b864d58d7f101dc1c1 ] Currently error return from kobject_init_and_add() is not followed by a call to kobject_put(). This means there is a memory leak. We currently set p to NULL so that kfree() may be called on it as a noop, the code is arguably clearer if we move the kfree() up closer to where it is called (instead of after goto jump). Remove a goto label 'err1' and jump to call to kobject_put() in error return from kobject_init_and_add() fixing the memory leak. Re-name goto label 'put_back' to 'err1' now that we don't use err1, following current nomenclature (err1, err2 ...). Move call to kfree out of the error code at bottom of function up to closer to where memory was allocated. Add comment to clarify call to kfree(). Signed-off-by: Tobin C. Harding Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/bridge/br_if.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) --- a/net/bridge/br_if.c +++ b/net/bridge/br_if.c @@ -460,13 +460,15 @@ int br_add_if(struct net_bridge *br, str call_netdevice_notifiers(NETDEV_JOIN, dev); err = dev_set_allmulti(dev, 1); - if (err) - goto put_back; + if (err) { + kfree(p); /* kobject not yet init'd, manually free */ + goto err1; + } err = kobject_init_and_add(&p->kobj, &brport_ktype, &(dev->dev.kobj), SYSFS_BRIDGE_PORT_ATTR); if (err) - goto err1; + goto err2; err = br_sysfs_addif(p); if (err) @@ -531,12 +533,9 @@ err3: sysfs_remove_link(br->ifobj, p->dev->name); err2: kobject_put(&p->kobj); - p = NULL; /* kobject_put frees */ -err1: dev_set_allmulti(dev, -1); -put_back: +err1: dev_put(dev); - kfree(p); return err; }