From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Armin Wolf <W_Armin@gmx.de>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>,
linux-pcmcia@lists.infradead.org
Subject: [PATCH AUTOSEL 4.14 6/9] pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
Date: Sun, 23 Jul 2023 21:35:48 -0400 [thread overview]
Message-ID: <20230724013554.2334965-6-sashal@kernel.org> (raw)
In-Reply-To: <20230724013554.2334965-1-sashal@kernel.org>
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit c85fd9422fe0f5d667305efb27f56d09eab120b0 ]
When nonstatic_release_resource_db() frees all resources associated
with an PCMCIA socket, it forgets to free socket_data too, causing
a memory leak observable with kmemleak:
unreferenced object 0xc28d1000 (size 64):
comm "systemd-udevd", pid 297, jiffies 4294898478 (age 194.484s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 f0 85 0e c3 00 00 00 00 ................
00 00 00 00 0c 10 8d c2 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffda4245>] __kmem_cache_alloc_node+0x2d7/0x4a0
[<7e51f0c8>] kmalloc_trace+0x31/0xa4
[<d52b4ca0>] nonstatic_init+0x24/0x1a4 [pcmcia_rsrc]
[<a2f13e08>] pcmcia_register_socket+0x200/0x35c [pcmcia_core]
[<a728be1b>] yenta_probe+0x4d8/0xa70 [yenta_socket]
[<c48fac39>] pci_device_probe+0x99/0x194
[<84b7c690>] really_probe+0x181/0x45c
[<8060fe6e>] __driver_probe_device+0x75/0x1f4
[<b9b76f43>] driver_probe_device+0x28/0xac
[<648b766f>] __driver_attach+0xeb/0x1e4
[<6e9659eb>] bus_for_each_dev+0x61/0xb4
[<25a669f3>] driver_attach+0x1e/0x28
[<d8671d6b>] bus_add_driver+0x102/0x20c
[<df0d323c>] driver_register+0x5b/0x120
[<942cd8a4>] __pci_register_driver+0x44/0x4c
[<e536027e>] __UNIQUE_ID___addressable_cleanup_module188+0x1c/0xfffff000 [iTCO_vendor_support]
Fix this by freeing socket_data too.
Tested on a Acer Travelmate 4002WLMi by manually binding/unbinding
the yenta_cardbus driver (yenta_socket).
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Message-ID: <20230512184529.5094-1-W_Armin@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pcmcia/rsrc_nonstatic.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index 2e96d9273b780..e5ec8a2c022a2 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -1056,6 +1056,8 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s)
q = p->next;
kfree(p);
}
+
+ kfree(data);
}
--
2.39.2
next prev parent reply other threads:[~2023-07-24 1:52 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-24 1:35 [PATCH AUTOSEL 4.14 1/9] media: v4l2-mem2mem: add lock to protect parameter num_rdy Sasha Levin
2023-07-24 1:35 ` [PATCH AUTOSEL 4.14 2/9] media: platform: mediatek: vpu: fix NULL ptr dereference Sasha Levin
2023-07-24 1:35 ` [PATCH AUTOSEL 4.14 3/9] xhci: Don't require a valid get_quirks() function pointer during xhci setup Sasha Levin
2023-07-24 4:08 ` Greg Kroah-Hartman
2023-07-24 1:35 ` [PATCH AUTOSEL 4.14 4/9] usb: cdns2: Device side header file for CDNS2 driver Sasha Levin
2023-07-24 1:35 ` [PATCH AUTOSEL 4.14 5/9] gfs2: Fix possible data races in gfs2_show_options() Sasha Levin
2023-07-24 1:35 ` Sasha Levin [this message]
2023-07-24 1:35 ` [PATCH AUTOSEL 4.14 7/9] Bluetooth: L2CAP: Fix use-after-free Sasha Levin
2023-07-24 1:35 ` [PATCH AUTOSEL 4.14 8/9] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb Sasha Levin
2023-07-24 1:35 ` [PATCH AUTOSEL 4.14 9/9] drm/amdgpu: Fix potential fence use-after-free v2 Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230724013554.2334965-6-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=W_Armin@gmx.de \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pcmcia@lists.infradead.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox