Subject: Re: [PATCH] net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject

From: [email-masked] (Jouni Högander)
Date: Wed, 20 Nov 2019 08:59:26 +0200

David Miller <[email-masked]> writes:

> From: [email-masked]
> Date: Tue, 19 Nov 2019 11:51:21 +0200
>
>> kobject_init_and_add takes reference even when it fails.
>
> I see this in the comment above kobject_init_and_add() but not in the
> code.
>
> Where does the implementation of kobject_init_and_add() actually take
> such a reference?

kobject_init_and_add -> kobject_init -> kobject_init_internal -> kref_init

kref_init initializes ref_count as 1.

>
> Did you discover this by code inspection, or by an actual bug that was
> triggered?  If by an actual bug, please provide the OOPS and/or checker
> trace that indicated a leak was happening here.

Originally found it via memory leak identified by Syzkaller. I will
submit new one with memleak dump.

>
> I don't see anything actually wrong here because kobject_init_and_add()
> doesn't actually seem to do what it's comment suggests...

See the code path above.

BR,

Jouni Högander