linux-kernel - Re: [PATCH] Input: fix error handling in input_register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025031350-nutty-gatherer-3e69@gregkh>
Date: Thu, 13 Mar 2025 11:01:05 +0100
From: Greg KH <gregkh@...uxfoundation.org>
To: Ma Ke <make24@...as.ac.cn>
Cc: dmitry.torokhov@...il.com, bentiss@...nel.org, jeff@...undy.com,
	linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
	akpm@...ux-foundation.org, stable@...r.kernel.org
Subject: Re: [PATCH] Input: fix error handling in input_register_device()

On Thu, Mar 13, 2025 at 04:38:03PM +0800, Ma Ke wrote:
> Once device_add() failed, we should call put_device() to decrement
> reference count for cleanup. Or it could cause memory leak.
> 
> As comment of device_add() says, 'if device_add() succeeds, you should
> call device_del() when you want to get rid of it. If device_add() has
> not succeeded, use only put_device() to drop the reference count'.
> 
> Found by code review.
> 
> Cc: stable@...r.kernel.org
> Fixes: 0cd587735205 ("Input: preallocate memory to hold event values")
> Signed-off-by: Ma Ke <make24@...as.ac.cn>
> ---
>  drivers/input/input.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/input/input.c b/drivers/input/input.c
> index c9e3ac64bcd0..2e70f346dadc 100644
> --- a/drivers/input/input.c
> +++ b/drivers/input/input.c
> @@ -2424,6 +2424,7 @@ int input_register_device(struct input_dev *dev)
>  err_device_del:
>  	device_del(&dev->dev);
>  err_devres_free:
> +	put_device(&dev->dev);

Did you test this?  This is not going to work properly for all places
that call this label.

While these types of fixes are nice to have, PLEASE TEST THEM!!!!

Stop doing these and verify, by actual tests, that they do what you
think they are doing before sending any more of them.  As it is, this
stream of "fixes" is just too full of bugs for any of us to trust them
at all.

thanks,

greg k-h