Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

of: unittest: Fix memory leak in unittest_data_add()

In unittest_data_add(), if of_resolve_phandles() fails, the allocated
unittest_data is not freed, leading to a memory leak.

Fix this by using scope-based cleanup helper __free(kfree) for automatic
resource cleanup. This ensures unittest_data is automatically freed when
it goes out of scope in error paths.

For the success path, use retain_and_null_ptr() to transfer ownership
of the memory to the device tree and prevent double freeing.

Fixes: 2eb46da2a760 ("of/selftest: Use the resolver to fixup phandles")
Suggested-by: Rob Herring <robh@kernel.org>
Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Link: https://patch.msgid.link/20251231114915.234638-1-zilin@seu.edu.cn
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>

authored by

Zilin Guan and committed by
Rob Herring (Arm)
235a1eb8 4f4f6b44

+3 -5
+3 -5
drivers/of/unittest.c
··· 1985 1985 */ 1986 1986 static int __init unittest_data_add(void) 1987 1987 { 1988 - void *unittest_data; 1989 1988 void *unittest_data_align; 1990 1989 struct device_node *unittest_data_node = NULL, *np; 1991 1990 /* ··· 2003 2004 } 2004 2005 2005 2006 /* creating copy */ 2006 - unittest_data = kmalloc(size + FDT_ALIGN_SIZE, GFP_KERNEL); 2007 + void *unittest_data __free(kfree) = kmalloc(size + FDT_ALIGN_SIZE, GFP_KERNEL); 2007 2008 if (!unittest_data) 2008 2009 return -ENOMEM; 2009 2010 ··· 2013 2014 ret = of_fdt_unflatten_tree(unittest_data_align, NULL, &unittest_data_node); 2014 2015 if (!ret) { 2015 2016 pr_warn("%s: unflatten testcases tree failed\n", __func__); 2016 - kfree(unittest_data); 2017 2017 return -ENODATA; 2018 2018 } 2019 2019 if (!unittest_data_node) { 2020 2020 pr_warn("%s: testcases tree is empty\n", __func__); 2021 - kfree(unittest_data); 2022 2021 return -ENODATA; 2023 2022 } 2024 2023 ··· 2035 2038 /* attach the sub-tree to live tree */ 2036 2039 if (!of_root) { 2037 2040 pr_warn("%s: no live tree to attach sub-tree\n", __func__); 2038 - kfree(unittest_data); 2039 2041 rc = -ENODEV; 2040 2042 goto unlock; 2041 2043 } ··· 2054 2058 2055 2059 EXPECT_END(KERN_INFO, 2056 2060 "Duplicate name in testcase-data, renamed to \"duplicate-name#1\""); 2061 + 2062 + retain_and_null_ptr(unittest_data); 2057 2063 2058 2064 unlock: 2059 2065 of_overlay_mutex_unlock();