CVE-2022-50578

In the Linux kernel, the following vulnerability has been resolved:

class: fix possible memory leak in __class_register()

If class_add_groups() returns error, the ‘cp->subsys’ need be
unregister, and the ‘cp’ need be freed.

We can not call kset_unregister() here, because the ‘cls’ will
be freed in callback function class_release() and it’s also
freed in caller’s error path, it will cause double free.

So fix this by calling kobject_del() and kfree_const(name) to
cleanup kobject. Besides, call kfree() to free the ‘cp’.

Fault injection test can trigger this:

unreferenced object 0xffff888102fa8190 (size 8):
comm “modprobe”, pid 502, jiffies 4294906074 (age 49.296s)
hex dump (first 8 bytes):
70 6b 74 63 64 76 64 00 pktcdvd.
backtrace:
[] __kmalloc_track_caller+0x1ae/0x320
[] kstrdup+0x3a/0x70
[] kstrdup_const+0x68/0x80
[] kvasprintf_const+0x10b/0x190
[] kobject_set_name_vargs+0x56/0x150
[] kobject_set_name+0xab/0xe0
[] __class_register+0x15c/0x49a

unreferenced object 0xffff888037274000 (size 1024):
comm “modprobe”, pid 502, jiffies 4294906074 (age 49.296s)
hex dump (first 32 bytes):
00 40 27 37 80 88 ff ff 00 40 27 37 80 88 ff ff .@’7…..@’7….
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 …..N……….
backtrace:
[] kmem_cache_alloc_trace+0x17c/0x2f0
[] __class_register+0x86/0x49a