From: Liu Jian liujian56@huawei.com
[ Upstream commit 1a392b3de7c5747506b38fc14b2e79977d3c7770 ]
'idev' is malloced in __uio_register_device() and leak free it before leaving from the uio_get_minor() error handing case, it will cause memory leak.
Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open") Signed-off-by: Liu Jian liujian56@huawei.com Reviewed-by: Hamish Martin hamish.martin@alliedtelesis.co.nz Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/uio/uio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c index 2762148c169df..e4b418757017f 100644 --- a/drivers/uio/uio.c +++ b/drivers/uio/uio.c @@ -938,8 +938,10 @@ int __uio_register_device(struct module *owner, atomic_set(&idev->event, 0);
ret = uio_get_minor(idev); - if (ret) + if (ret) { + kfree(idev); return ret; + }
idev->dev.devt = MKDEV(uio_major, idev->minor); idev->dev.class = &uio_class;