kobject_init_and_add() takes reference even when it fails. If this
function returns an error in edd_device_register(), kobject_put() should
be called to properly clean up the memory associated with the object.
The release callback frees the enclosing edd_device, but the current
error path returns without dropping the reference, so the release callback
is not invoked.
This issue was found by a static analysis tool I am developing.
Fixes: dd002e807486 ("Kobject: change drivers/firmware/edd.c to use kobject_init_and_add")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
drivers/firmware/edd.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/firmware/edd.c b/drivers/firmware/edd.c
index f980c5b56858..f26eae48774f 100644
--- a/drivers/firmware/edd.c
+++ b/drivers/firmware/edd.c
@@ -708,6 +708,8 @@ edd_device_register(struct edd_device *edev, int i)
if (!error) {
edd_populate_dir(edev);
kobject_uevent(&edev->kobj, KOBJ_ADD);
+ } else {
+ kobject_put(&edev->kobj);
}
return error;
}
--
2.43.0