]> git.itanic.dy.fi Git - linux-stable/commit
driver core: class: properly reference count class_dev_iter()
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 16 May 2023 19:20:14 +0000 (21:20 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 19 May 2023 10:03:36 +0000 (11:03 +0100)
commitddaf098ea779b3c1302c7843f6ff01e89b1fd380
tree50bab0c29d67b5924ac954ca82832fef67c51ba6
parent1e94be78ec1556e90056ac038b15231723d315a9
driver core: class: properly reference count class_dev_iter()

When class_dev_iter is initialized, the reference count for the subsys
private structure is incremented, but never decremented, causing a
memory leak over time.  To resolve this, save off a pointer to the
internal structure into the class_dev_iter structure and then when the
iterator is finished, drop the reference count.

Reported-and-tested-by: syzbot+e7afd76ad060fa0d2605@syzkaller.appspotmail.com
Fixes: 7b884b7f24b4 ("driver core: class.c: convert to only use class_to_subsys")
Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Cc: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Rafael J. Wysocki <rafael@kernel.org>
Tested-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Link: https://lore.kernel.org/r/2023051610-stove-condense-9a77@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/base/class.c
include/linux/device/class.h