linux-kernel - [PATCH 1/4] staging: comedi: 8255: fix I/O region leak on failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 22 May 2015 16:21:35 +0100
From:	Ian Abbott <abbotti@....co.uk>
To:	<driverdev-devel@...uxdriverproject.org>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Ian Abbott <abbotti@....co.uk>,
	H Hartley Sweeten <hsweeten@...ionengravers.com>,
	<linux-kernel@...r.kernel.org>
Subject: [PATCH 1/4] staging: comedi: 8255: fix I/O region leak on failure

The Comedi "8255" driver does not clean up properly on failure.  It can
leave requested I/O port regions unreleased.  Specifically, the Comedi
"attach" handler (`dev_8255_attach()`) requests a specified I/O port
region before calling `subdev_8255_init()` to set up the subdevice.  If
that fails, the "attach" handler returns an error and the Comedi core
will call the "detach" handler (`dev_8255_detach()`) to clean up.  The
"detach" handler is responsible for releasing the I/O port regions
successfully requested by the "attach" handler.  Unfortunately, it is
unable to obtain the base address of the region if the call to
`subdev_8255_init()` failed.

Fix the I/O region leak by releasing the region in the "attach" handler
directly if the call to `subdev_8255_init()` fails.

Signed-off-by: Ian Abbott <abbotti@....co.uk>
---
 drivers/staging/comedi/drivers/8255.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/8255.c b/drivers/staging/comedi/drivers/8255.c
index ba89321..0fdf834 100644
--- a/drivers/staging/comedi/drivers/8255.c
+++ b/drivers/staging/comedi/drivers/8255.c
@@ -306,8 +306,15 @@ static int dev_8255_attach(struct comedi_device *dev,
 			s->type = COMEDI_SUBD_UNUSED;
 		} else {
 			ret = subdev_8255_init(dev, s, NULL, iobase);
-			if (ret)
+			if (ret) {
+				/*
+				 * Release the I/O port region here, as the
+				 * "detach" handler cannot find it.
+				 */
+				release_region(iobase, I8255_SIZE);
+				s->type = COMEDI_SUBD_UNUSED;
 				return ret;
+			}
 		}
 	}

-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/