Commit 6c7b2bec authored by Patrick Mochel's avatar Patrick Mochel

[kobject] Fix memory leak in kobject_set_name().

If kobject_set_name() is called when the kobject already has a name that was
dynamically allocated (too long for the static array), then we must free that
memory. 

Noticed by Jon Corbet. 
parent 402f1b9f
...@@ -331,6 +331,7 @@ int kobject_set_name(struct kobject * kobj, const char * fmt, ...) ...@@ -331,6 +331,7 @@ int kobject_set_name(struct kobject * kobj, const char * fmt, ...)
int limit = KOBJ_NAME_LEN; int limit = KOBJ_NAME_LEN;
int need; int need;
va_list args; va_list args;
char * name;
va_start(args,fmt); va_start(args,fmt);
/* /*
...@@ -338,25 +339,33 @@ int kobject_set_name(struct kobject * kobj, const char * fmt, ...) ...@@ -338,25 +339,33 @@ int kobject_set_name(struct kobject * kobj, const char * fmt, ...)
*/ */
need = vsnprintf(kobj->name,limit,fmt,args); need = vsnprintf(kobj->name,limit,fmt,args);
if (need < limit) if (need < limit)
kobj->k_name = kobj->name; name = kobj->name;
else { else {
/* /*
* Need more space? Allocate it and try again * Need more space? Allocate it and try again
*/ */
kobj->k_name = kmalloc(need,GFP_KERNEL); name = kmalloc(need,GFP_KERNEL);
if (!kobj->k_name) { if (!name) {
error = -ENOMEM; error = -ENOMEM;
goto Done; goto Done;
} }
limit = need; limit = need;
need = vsnprintf(kobj->k_name,limit,fmt,args); need = vsnprintf(name,limit,fmt,args);
/* Still? Give up. */ /* Still? Give up. */
if (need > limit) { if (need > limit) {
kfree(kobj->k_name); kfree(name);
error = -EFAULT; error = -EFAULT;
goto Done;
} }
} }
/* Free the old name, if necessary. */
if (kobj->k_name && kobj->k_name != kobj->name)
kfree(kobj->k_name);
/* Now, set the new name */
kobj->k_name = name;
Done: Done:
va_end(args); va_end(args);
return error; return error;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment