forked from luck/tmp_suning_uos_patched
797c128d3c
commit 37309f47e2f5674f3e86cb765312ace42cfcedf5 upstream. As reported by syzbot below, kfifo_alloc'd memory would not be freed if a non-zero return value is triggered in wacom_probe. This patch creates and uses devm_kfifo_alloc to allocate and free itself. BUG: memory leak unreferenced object 0xffff88810dc44a00 (size 512): comm "kworker/1:2", pid 3674, jiffies 4294943617 (age 14.100s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000023e1afac>] kmalloc_array include/linux/slab.h:592 [inline] [<0000000023e1afac>] __kfifo_alloc+0xad/0x100 lib/kfifo.c:43 [<00000000c477f737>] wacom_probe+0x1a1/0x3b0 drivers/hid/wacom_sys.c:2727 [<00000000b3109aca>] hid_device_probe+0x16b/0x210 drivers/hid/hid-core.c:2281 [<00000000aff7c640>] really_probe+0x159/0x480 drivers/base/dd.c:554 [<00000000778d0bc3>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738 [<000000005108dbb5>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844 [<00000000efb7c59e>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431 [<0000000024ab1590>] __device_attach+0x122/0x250 drivers/base/dd.c:912 [<000000004c7ac048>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491 [<00000000b93050a3>] device_add+0x5ac/0xc30 drivers/base/core.c:2936 [<00000000e5b46ea5>] hid_add_device+0x151/0x390 drivers/hid/hid-core.c:2437 [<00000000c6add147>] usbhid_probe+0x412/0x560 drivers/hid/usbhid/hid-core.c:1407 [<00000000c33acdb4>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<00000000aff7c640>] really_probe+0x159/0x480 drivers/base/dd.c:554 [<00000000778d0bc3>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738 [<000000005108dbb5>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844 https://syzkaller.appspot.com/bug?extid=5b49c9695968d7250a26 Reported-by: syzbot+5b49c9695968d7250a26@syzkaller.appspotmail.com Signed-off-by: Ping Cheng <ping.cheng@wacom.com> Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| i2c-hid | ||
| intel-ish-hid | ||
| usbhid | ||
| hid-a4tech.c | ||
| hid-accutouch.c | ||
| hid-alps.c | ||
| hid-apple.c | ||
| hid-appleir.c | ||
| hid-asus.c | ||
| hid-aureal.c | ||
| hid-axff.c | ||
| hid-belkin.c | ||
| hid-betopff.c | ||
| hid-bigbenff.c | ||
| hid-cherry.c | ||
| hid-chicony.c | ||
| hid-cmedia.c | ||
| hid-core.c | ||
| hid-corsair.c | ||
| hid-cougar.c | ||
| hid-cp2112.c | ||
| hid-creative-sb0540.c | ||
| hid-cypress.c | ||
| hid-debug.c | ||
| hid-dr.c | ||
| hid-elan.c | ||
| hid-elecom.c | ||
| hid-elo.c | ||
| hid-emsff.c | ||
| hid-ezkey.c | ||
| hid-gaff.c | ||
| hid-gembird.c | ||
| hid-generic.c | ||
| hid-gfrm.c | ||
| hid-glorious.c | ||
| hid-google-hammer.c | ||
| hid-gt683r.c | ||
| hid-gyration.c | ||
| hid-holtek-kbd.c | ||
| hid-holtek-mouse.c | ||
| hid-holtekff.c | ||
| hid-hyperv.c | ||
| hid-icade.c | ||
| hid-ids.h | ||
| hid-input.c | ||
| hid-ite.c | ||
| hid-jabra.c | ||
| hid-kensington.c | ||
| hid-keytouch.c | ||
| hid-kye.c | ||
| hid-lcpower.c | ||
| hid-led.c | ||
| hid-lenovo.c | ||
| hid-lg-g15.c | ||
| hid-lg.c | ||
| hid-lg.h | ||
| hid-lg2ff.c | ||
| hid-lg3ff.c | ||
| hid-lg4ff.c | ||
| hid-lg4ff.h | ||
| hid-lgff.c | ||
| hid-logitech-dj.c | ||
| hid-logitech-hidpp.c | ||
| hid-macally.c | ||
| hid-magicmouse.c | ||
| hid-maltron.c | ||
| hid-mcp2221.c | ||
| hid-mf.c | ||
| hid-microsoft.c | ||
| hid-monterey.c | ||
| hid-multitouch.c | ||
| hid-nti.c | ||
| hid-ntrig.c | ||
| hid-ortek.c | ||
| hid-penmount.c | ||
| hid-petalynx.c | ||
| hid-picolcd_backlight.c | ||
| hid-picolcd_cir.c | ||
| hid-picolcd_core.c | ||
| hid-picolcd_debugfs.c | ||
| hid-picolcd_fb.c | ||
| hid-picolcd_lcd.c | ||
| hid-picolcd_leds.c | ||
| hid-picolcd.h | ||
| hid-pl.c | ||
| hid-plantronics.c | ||
| hid-primax.c | ||
| hid-prodikeys.c | ||
| hid-quirks.c | ||
| hid-redragon.c | ||
| hid-retrode.c | ||
| hid-rmi.c | ||
| hid-roccat-arvo.c | ||
| hid-roccat-arvo.h | ||
| hid-roccat-common.c | ||
| hid-roccat-common.h | ||
| hid-roccat-isku.c | ||
| hid-roccat-isku.h | ||
| hid-roccat-kone.c | ||
| hid-roccat-kone.h | ||
| hid-roccat-koneplus.c | ||
| hid-roccat-koneplus.h | ||
| hid-roccat-konepure.c | ||
| hid-roccat-kovaplus.c | ||
| hid-roccat-kovaplus.h | ||
| hid-roccat-lua.c | ||
| hid-roccat-lua.h | ||
| hid-roccat-pyra.c | ||
| hid-roccat-pyra.h | ||
| hid-roccat-ryos.c | ||
| hid-roccat-savu.c | ||
| hid-roccat-savu.h | ||
| hid-roccat.c | ||
| hid-saitek.c | ||
| hid-samsung.c | ||
| hid-sensor-custom.c | ||
| hid-sensor-hub.c | ||
| hid-sjoy.c | ||
| hid-sony.c | ||
| hid-speedlink.c | ||
| hid-steam.c | ||
| hid-steelseries.c | ||
| hid-sunplus.c | ||
| hid-tivo.c | ||
| hid-tmff.c | ||
| hid-topseed.c | ||
| hid-twinhan.c | ||
| hid-u2fzero.c | ||
| hid-uclogic-core.c | ||
| hid-uclogic-params.c | ||
| hid-uclogic-params.h | ||
| hid-uclogic-rdesc.c | ||
| hid-uclogic-rdesc.h | ||
| hid-udraw-ps3.c | ||
| hid-viewsonic.c | ||
| hid-vivaldi.c | ||
| hid-waltop.c | ||
| hid-wiimote-core.c | ||
| hid-wiimote-debug.c | ||
| hid-wiimote-modules.c | ||
| hid-wiimote.h | ||
| hid-xinmo.c | ||
| hid-zpff.c | ||
| hid-zydacron.c | ||
| hidraw.c | ||
| Kconfig | ||
| Makefile | ||
| uhid.c | ||
| wacom_sys.c | ||
| wacom_wac.c | ||
| wacom_wac.h | ||
| wacom.h | ||