Skip to content

Commit 6b74d43

Browse files
Ma Kejfvogel
authored andcommitted
PCI: Fix reference leak in pci_register_host_bridge()
commit 804443c1f27883926de94c849d91f5b7d7d696e9 upstream. If device_register() fails, call put_device() to give up the reference to avoid a memory leak, per the comment at device_register(). Found by code review. Link: https://lore.kernel.org/r/[email protected] Fixes: 37d6a0a ("PCI: Add pci_register_host_bridge() interface") Signed-off-by: Ma Ke <[email protected]> [bhelgaas: squash Dan Carpenter's double free fix from https://lore.kernel.org/r/[email protected]] Signed-off-by: Bjorn Helgaas <[email protected]> Cc: [email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]> (cherry picked from commit 9707d0c932f41006a2701afc926b232b50e356b4) Signed-off-by: Jack Vogel <[email protected]>
1 parent 6242b5b commit 6b74d43

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

drivers/pci/probe.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -908,6 +908,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
908908
resource_size_t offset, next_offset;
909909
LIST_HEAD(resources);
910910
struct resource *res, *next_res;
911+
bool bus_registered = false;
911912
char addr[64], *fmt;
912913
const char *name;
913914
int err;
@@ -971,6 +972,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
971972
name = dev_name(&bus->dev);
972973

973974
err = device_register(&bus->dev);
975+
bus_registered = true;
974976
if (err)
975977
goto unregister;
976978

@@ -1057,12 +1059,15 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
10571059
unregister:
10581060
put_device(&bridge->dev);
10591061
device_del(&bridge->dev);
1060-
10611062
free:
10621063
#ifdef CONFIG_PCI_DOMAINS_GENERIC
10631064
pci_bus_release_domain_nr(parent, bus->domain_nr);
10641065
#endif
1065-
kfree(bus);
1066+
if (bus_registered)
1067+
put_device(&bus->dev);
1068+
else
1069+
kfree(bus);
1070+
10661071
return err;
10671072
}
10681073

0 commit comments

Comments
 (0)