Subject: Re: [PATCH] net-sysfs: Fix reference count leak

From: [email-masked] (Jouni Högander)
Date: Mon, 18 Nov 2019 11:25:05 +0200

Greg Kroah-Hartman <[email-masked]> writes:

> On Fri, Nov 15, 2019 at 02:24:12PM +0200, [email-masked] wrote:
>>  net/core/net-sysfs.c | 21 ++++++++++++++++-----
>>  1 file changed, 16 insertions(+), 5 deletions(-)
>> 
>> diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
>> index 865ba6ca16eb..72ecad583953 100644
>> --- a/net/core/net-sysfs.c
>> +++ b/net/core/net-sysfs.c
>> @@ -1626,6 +1626,12 @@ static void netdev_release(struct device *d)
>>  {
>>  	struct net_device *dev = to_net_dev(d);
>>  
>> +	/* Triggered by an error clean-up (put_device) during
>> +	 * initialization.
>> +	 */
>> +	if (dev->reg_state == NETREG_UNINITIALIZED)
>> +		return;
>> +
>
> Are you sure about this?  What about the memory involved here, what will
> free that?

In net/core/dev.c:free_netdev:

        /*  Compatibility with error handling in drivers */
	if (dev->reg_state == NETREG_UNINITIALIZED) {
		netdev_freemem(dev);
		return;
	}

I.e. driver is expected calling free_netdev in case of error and freeing
of device structure is done there. This brings up the question wether
put_device should be actually called in free_netdev also in error case?
Maybe that would be more correct as this free_netdev exists.

BR,

Jouni Högander