linux-kernel - mcb: correct error handling in mcb_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1555497224-72490-1-git-send-email-bianpan2016@163.com>
Date:   Wed, 17 Apr 2019 18:33:44 +0800
From:   Pan Bian <bianpan2016@....com>
To:     Johannes Thumshirn <morbidrsa@...il.com>
Cc:     linux-kernel@...r.kernel.org, Pan Bian <bianpan2016@....com>
Subject: mcb: correct error handling in mcb_alloc_bus

There are two issues in the error handling code. First, if ID allocation
fails, the reference count of carrier is decremented, which has
not been incremented yet. Second, if device_add fails, the allocated ID
will not be released. This patches fixes them.

Signed-off-by: Pan Bian <bianpan2016@....com>
---
 drivers/mcb/mcb-core.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
index bb5c569..b5c6a1b 100644
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -280,8 +280,8 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier)
 
 	bus_nr = ida_simple_get(&mcb_ida, 0, 0, GFP_KERNEL);
 	if (bus_nr < 0) {
-		rc = bus_nr;
-		goto err_free;
+		kfree(bus);
+		return ERR_PTR(bus_nr);
 	}
 
 	bus->bus_nr = bus_nr;
@@ -296,12 +296,11 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier)
 	dev_set_name(&bus->dev, "mcb:%d", bus_nr);
 	rc = device_add(&bus->dev);
 	if (rc)
-		goto err_free;
+		goto err_put;
 
 	return bus;
-err_free:
-	put_device(carrier);
-	kfree(bus);
+err_put:
+	put_device(&bus->dev);
 	return ERR_PTR(rc);
 }
 EXPORT_SYMBOL_GPL(mcb_alloc_bus);
-- 
2.7.4