probe_gdrom() allocates a gendisk with blk_mq_alloc_disk(), but
remove_gdrom() only calls del_gendisk() during driver removal.
del_gendisk() unregisters the disk but does not drop the driver's
reference to the gendisk. Without a matching put_disk(), the reference
remains held and the gendisk is leaked.
Call put_disk() during remove_gdrom() to release the reference acquired
during disk allocation.
This issue was found by manual code inspection.
Fixes: 74ee1a7590b78 ("cdrom: Add support for Sega Dreamcast GD-ROM.")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
drivers/cdrom/gdrom.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
index 4ba4dd06cbf4..cd8c79e4a5ac 100644
--- a/drivers/cdrom/gdrom.c
+++ b/drivers/cdrom/gdrom.c
@@ -841,6 +841,7 @@ static void remove_gdrom(struct platform_device *devptr)
if (gdrom_major)
unregister_blkdev(gdrom_major, GDROM_DEV_NAME);
unregister_cdrom(gd.cd_info);
+ put_disk(gd.disk);
kfree(gd.cd_info);
kfree(gd.toc);
}
--
2.43.0