| From c7892ae13e461ed20154321eb792e07ebe38f5b3 Mon Sep 17 00:00:00 2001 |
| From: Yang Yingliang <yangyingliang@huawei.com> |
| Date: Fri, 22 Oct 2021 09:43:23 +0800 |
| Subject: pinctrl: core: fix possible memory leak in pinctrl_enable() |
| |
| From: Yang Yingliang <yangyingliang@huawei.com> |
| |
| commit c7892ae13e461ed20154321eb792e07ebe38f5b3 upstream. |
| |
| I got memory leak as follows when doing fault injection test: |
| |
| unreferenced object 0xffff888020a7a680 (size 64): |
| comm "i2c-mcp23018-41", pid 23090, jiffies 4295160544 (age 8.680s) |
| hex dump (first 32 bytes): |
| 00 48 d3 1e 80 88 ff ff 00 1a 56 c1 ff ff ff ff .H........V..... |
| 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ |
| backtrace: |
| [<0000000083c79b35>] kmem_cache_alloc_trace+0x16d/0x360 |
| [<0000000051803c95>] pinctrl_init_controller+0x6ed/0xb70 |
| [<0000000064346707>] pinctrl_register+0x27/0x80 |
| [<0000000029b0e186>] devm_pinctrl_register+0x5b/0xe0 |
| [<00000000391f5a3e>] mcp23s08_probe_one+0x968/0x118a [pinctrl_mcp23s08] |
| [<000000006112c039>] mcp230xx_probe+0x266/0x560 [pinctrl_mcp23s08_i2c] |
| |
| If pinctrl_claim_hogs() fails, the 'pindesc' allocated in pinctrl_register_one_pin() |
| need be freed. |
| |
| Cc: stable@vger.kernel.org |
| Reported-by: Hulk Robot <hulkci@huawei.com> |
| Fixes: 950b0d91dc10 ("pinctrl: core: Fix regression caused by delayed work for hogs") |
| Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> |
| Link: https://lore.kernel.org/r/20211022014323.1156924-1-yangyingliang@huawei.com |
| Signed-off-by: Linus Walleij <linus.walleij@linaro.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/pinctrl/core.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/drivers/pinctrl/core.c |
| +++ b/drivers/pinctrl/core.c |
| @@ -2055,6 +2055,8 @@ int pinctrl_enable(struct pinctrl_dev *p |
| if (error) { |
| dev_err(pctldev->dev, "could not claim hogs: %i\n", |
| error); |
| + pinctrl_free_pindescs(pctldev, pctldev->desc->pins, |
| + pctldev->desc->npins); |
| mutex_destroy(&pctldev->mutex); |
| kfree(pctldev); |
| |
