linux-kernel - [PATCH 4/5] drm:drm_usb: fix resource leak in drm_get_usb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20131030231135.GB5719@udknight>
Date:	Thu, 31 Oct 2013 07:11:35 +0800
From:	Wang YanQing <udknight@...il.com>
To:	airlied@...ux.ie
Cc:	dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: [PATCH 4/5] drm:drm_usb: fix resource leak in drm_get_usb_dev

We should call drm_cleanup_in_dev in error handle
code path after drm_fill_in_dev had been called,
or it will cause resource leak heavily, vmalloc
leak etc.

This patch also add call to dev->unload in error
handle code path.

Signed-off-by: Wang YanQing <udknight@...il.com>
---
 drivers/gpu/drm/drm_usb.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/drm_usb.c b/drivers/gpu/drm/drm_usb.c
index 34a156f..7e4de60 100644
--- a/drivers/gpu/drm/drm_usb.c
+++ b/drivers/gpu/drm/drm_usb.c
@@ -31,23 +31,23 @@ int drm_get_usb_dev(struct usb_interface *interface,
 	usb_set_intfdata(interface, dev);
 	ret = drm_get_minor(dev, &dev->control, DRM_MINOR_CONTROL);
 	if (ret)
-		goto err_g1;
+		goto err_g2;
 
 	ret = drm_get_minor(dev, &dev->primary, DRM_MINOR_LEGACY);
 	if (ret)
-		goto err_g2;
+		goto err_g3;
 
 	if (dev->driver->load) {
 		ret = dev->driver->load(dev, 0);
 		if (ret)
-			goto err_g3;
+			goto err_g4;
 	}
 
 	/* setup the grouping for the legacy output */
 	ret = drm_mode_group_init_legacy_group(dev,
 					       &dev->primary->mode_group);
 	if (ret)
-		goto err_g3;
+		goto err_g5;
 
 	list_add_tail(&dev->driver_item, &driver->device_list);
 
@@ -58,11 +58,15 @@ int drm_get_usb_dev(struct usb_interface *interface,
 		 driver->date, dev->primary->index);
 
 	return 0;
-
-err_g3:
+err_g5:
+	if (dev->driver->unload)
+		dev->driver->unload(dev);
+err_g4:
 	drm_put_minor(&dev->primary);
-err_g2:
+err_g3:
 	drm_put_minor(&dev->control);
+err_g2:
+	drm_cleanup_in_dev(dev);
 err_g1:
 	kfree(dev);
 	mutex_unlock(&drm_global_mutex);
-- 
1.7.12.4.dirty
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/