linux-kernel - Re: [PATCH v2 1/2] most: core: fix resource leak in most_register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <de935747-acb4-4f08-a84e-e017b7d0f90c@gmail.com>
Date: Wed, 26 Nov 2025 04:40:27 +0530
From: Navaneeth K <knavaneeth786@...il.com>
To: parthiban.veerasooran@...rochip.com, christian.gromm@...rochip.com,
 gregkh@...uxfoundation.org
Cc: linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 1/2] most: core: fix resource leak in
 most_register_interface error paths

Apologies, I missed adding the credit for the original finding.
If a v3 is needed for other reasons, I will include it. Otherwise, if 
this is merged, please add:
Reported-by: Abdun Nihaal <abdun.nihaal@...il.com>


On 26-11-2025 04:26, Navaneeth K wrote:
> The function most_register_interface() did not correctly release resources
> if it failed early (before device_register). In these cases, it returned
> an error code immediately, leaking the memory allocated for the interface.
>
> Fix this by initializing the device early via device_initialize() and
> calling put_device() on all error paths. This ensures the release
> callback is triggered to free memory.
>
> Switch to using device_add() instead of device_register() to handle
> the split initialization.
>
> Signed-off-by: Navaneeth K <knavaneeth786@...il.com>
> ---
>   drivers/most/core.c | 9 +++++++--
>   1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/most/core.c b/drivers/most/core.c
> index da319d108ea1d..8635fd08035e9 100644
> --- a/drivers/most/core.c
> +++ b/drivers/most/core.c
> @@ -1283,18 +1283,23 @@ int most_register_interface(struct most_interface *iface)
>   	struct most_channel *c;
>   
>   	if (!iface || !iface->enqueue || !iface->configure ||
> -	    !iface->poison_channel || (iface->num_channels > MAX_CHANNELS))
> +	    !iface->poison_channel || (iface->num_channels > MAX_CHANNELS) ||
> +	    !iface->dev)
>   		return -EINVAL;
>   
> +	device_initialize(iface->dev);
> +
>   	id = ida_alloc(&mdev_id, GFP_KERNEL);
>   	if (id < 0) {
>   		dev_err(iface->dev, "Failed to allocate device ID\n");
> +		put_device(iface->dev);
>   		return id;
>   	}
>   
>   	iface->p = kzalloc(sizeof(*iface->p), GFP_KERNEL);
>   	if (!iface->p) {
>   		ida_free(&mdev_id, id);
> +		put_device(iface->dev);
>   		return -ENOMEM;
>   	}
>   
> @@ -1304,7 +1309,7 @@ int most_register_interface(struct most_interface *iface)
>   	iface->dev->bus = &mostbus;
>   	iface->dev->groups = interface_attr_groups;
>   	dev_set_drvdata(iface->dev, iface);
> -	if (device_register(iface->dev)) {
> +	if (device_add(iface->dev)) {
>   		dev_err(iface->dev, "Failed to register interface device\n");
>   		kfree(iface->p);
>   		put_device(iface->dev);