linux-kernel - [PATCH 3/3] pinctrl: sunxi: Don't leak memory in case krealloc() failes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 30 Sep 2016 14:14:13 +0200
From:   Johannes Thumshirn <jthumshirn@...e.de>
To:     Linus Walleij <linus.walleij@...aro.org>
Cc:     linux-gpio@...r.kernel.org, linux-kernel@...r.kernel.org,
        Johannes Thumshirn <jthumshirn@...e.de>
Subject: [PATCH 3/3] pinctrl: sunxi: Don't leak memory in case krealloc() failes

If krealloc() fails there's no way of freeing the memory previously allocated
for pctl->functions as it is overwritten by krealloc()'s return value. Fix
this by assigning the return value to a temporary variable first so we can do
error handling (which we didn't do at all before).

Signed-off-by: Johannes Thumshirn <jthumshirn@...e.de>
---
 drivers/pinctrl/sunxi/pinctrl-sunxi.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 54455af..57dd09b 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -787,6 +787,7 @@ static int sunxi_pinctrl_add_function(struct sunxi_pinctrl *pctl,
 static int sunxi_pinctrl_build_state(struct platform_device *pdev)
 {
 	struct sunxi_pinctrl *pctl = platform_get_drvdata(pdev);
+	struct sunxi_pinctrl_function *functions;
 	int i;
 
 	pctl->ngroups = pctl->desc->npins;
@@ -833,9 +834,14 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
 		}
 	}
 
-	pctl->functions = krealloc(pctl->functions,
-				pctl->nfunctions * sizeof(*pctl->functions),
-				GFP_KERNEL);
+	functions = krealloc(pctl->functions,
+			     pctl->nfunctions * sizeof(*pctl->functions),
+			     GFP_KERNEL);
+	if (!functions) {
+		kfree(pctl->functions);
+		return -ENOMEM;
+	}
+	pctl->functions = functions;
 
 	for (i = 0; i < pctl->desc->npins; i++) {
 		const struct sunxi_desc_pin *pin = pctl->desc->pins + i;
-- 
1.8.5.6