Commit 66a834d0 authored by Ming Lei's avatar Ming Lei Committed by Martin K. Petersen
Browse files

scsi: core: Fix error handling of scsi_host_alloc() 

After device is initialized via device_initialize(), or its name is set via
dev_set_name(), the device has to be freed via put_device().  Otherwise
device name will be leaked because it is allocated dynamically in
dev_set_name().

Fix the leak by replacing kfree() with put_device(). Since
scsi_host_dev_release() properly handles IDA and kthread removal, remove
special-casing these from the error handling as well.

Link: https://lore.kernel.org/r/20210602133029.2864069-2-ming.lei@redhat.com


Cc: Bart Van Assche <bvanassche@acm.org>
Cc: John Garry <john.garry@huawei.com>
Cc: Hannes Reinecke <hare@suse.de>
Tested-by: default avatarJohn Garry <john.garry@huawei.com>
Reviewed-by: default avatarBart Van Assche <bvanassche@acm.org>
Reviewed-by: default avatarJohn Garry <john.garry@huawei.com>
Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent e57f5cd9

drivers/scsi/hosts.c

+13 −10
Original line number Diff line number Diff line
@@ -388,8 +388,10 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) 
	mutex_init(&shost->scan_mutex);



	index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL);

	if (index < 0)

		goto fail_kfree;

	if (index < 0) {

		kfree(shost);

		return NULL;

	}

	shost->host_no = index;



	shost->dma_channel = 0xff;
@@ -481,7 +483,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) 
		shost_printk(KERN_WARNING, shost,

			"error handler thread failed to spawn, error = %ld\n",

			PTR_ERR(shost->ehandler));

		goto fail_index_remove;

		goto fail;

	}



	shost->tmf_work_q = alloc_workqueue("scsi_tmf_%d",
@@ -490,17 +492,18 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) 
	if (!shost->tmf_work_q) {

		shost_printk(KERN_WARNING, shost,

			     "failed to create tmf workq\n");

		goto fail_kthread;

		goto fail;

	}

	scsi_proc_hostdir_add(shost->hostt);

	return shost;

 fail:

	/*

	 * Host state is still SHOST_CREATED and that is enough to release

	 * ->shost_gendev. scsi_host_dev_release() will free

	 * dev_name(&shost->shost_dev).

	 */

	put_device(&shost->shost_gendev);



 fail_kthread:

	kthread_stop(shost->ehandler);

 fail_index_remove:

	ida_simple_remove(&host_index_ida, shost->host_no);

 fail_kfree:

	kfree(shost);

	return NULL;

}

EXPORT_SYMBOL(scsi_host_alloc);