[kobject] Fix memory leak in kobject_set_name().

If kobject_set_name() is called when the kobject already has a name that was
dynamically allocated (too long for the static array), then we must free that
memory. 

Noticed by Jon Corbet. 

1 files changed, 14 insertions, 5 deletions

diff --git a/lib/kobject.c b/lib/kobject.c
index 64f61d1f68a914..ff65c0f2c98fcf 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -331,6 +331,7 @@ int kobject_set_name(struct kobject * kobj, const char * fmt, ...)
 	int limit = KOBJ_NAME_LEN;
 	int need;
 	va_list args;
+	char * name;
 
 	va_start(args,fmt);
 	/* 
@@ -338,25 +339,33 @@ int kobject_set_name(struct kobject * kobj, const char * fmt, ...)
 	 */
 	need = vsnprintf(kobj->name,limit,fmt,args);
 	if (need < limit) 
-		kobj->k_name = kobj->name;
+		name = kobj->name;
 	else {
 		/* 
 		 * Need more space? Allocate it and try again 
 		 */
-		kobj->k_name = kmalloc(need,GFP_KERNEL);
-		if (!kobj->k_name) {
+		name = kmalloc(need,GFP_KERNEL);
+		if (!name) {
 			error = -ENOMEM;
 			goto Done;
 		}
 		limit = need;
-		need = vsnprintf(kobj->k_name,limit,fmt,args);
+		need = vsnprintf(name,limit,fmt,args);
 
 		/* Still? Give up. */
 		if (need > limit) {
-			kfree(kobj->k_name);
+			kfree(name);
 			error = -EFAULT;
+			goto Done;
 		}
 	}
+
+	/* Free the old name, if necessary. */
+	if (kobj->k_name && kobj->k_name != kobj->name)
+		kfree(kobj->k_name);
+
+	/* Now, set the new name */
+	kobj->k_name = name;
  Done:
 	va_end(args);
 	return error;