linux-kernel - Commit 09d28d2c19 introduces set-after-free in arch/arm/mach-omap2/mcbsp.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111211170813.02fd478a@notabene.brown>
Date:	Sun, 11 Dec 2011 17:08:13 +1100
From:	NeilBrown <neilb@...e.de>
To:	Jarkko Nikula <jarkko.nikula@...mer.com>
Cc:	Peter Ujfalusi <peter.ujfalusi@...com>,
	Janusz Krzysztofik <jkrzyszt@....icnet.pl>,
	Tony Lindgren <tony@...mide.com>, linux-omap@...r.kernel.org,
	lkml <linux-kernel@...r.kernel.org>
Subject: Commit 09d28d2c19 introduces set-after-free in
 arch/arm/mach-omap2/mcbsp.c



Hi,

commit 09d28d2c19fe5c2d51b3133329584166dec89f86
Author: Jarkko Nikula <jarkko.nikula@...mer.com>
Date:   Mon Sep 26 10:45:48 2011 +0300

    ARM: OMAP: mcbsp: Start generalize omap2_mcbsp_set_clks_src
    
...

contains (when displayed with "-U10"):

diff --git a/arch/arm/mach-omap2/mcbsp.c b/arch/arm/mach-omap2/mcbsp.c
index 92bd5e2..3dd4c47 100644
--- a/arch/arm/mach-omap2/mcbsp.c
+++ b/arch/arm/mach-omap2/mcbsp.c
....
@@ -181,20 +173,21 @@ static int omap_init_mcbsp(struct omap_hwmod *oh, void *unused)
        }
        pdev = omap_device_build_ss(name, id, oh_device, count, pdata,
                                sizeof(*pdata), omap2_mcbsp_latency,
                                ARRAY_SIZE(omap2_mcbsp_latency), false);
        kfree(pdata);
        if (IS_ERR(pdev))  {
                pr_err("%s: Can't build omap_device for %s:%s.\n", __func__,
                                        name, oh->name);
                return PTR_ERR(pdev);
        }
+       pdata->set_clk_src = omap2_mcbsp_set_clk_src;
        omap_mcbsp_count++;
        return 0;
 }
 
 static int __init omap2_mcbsp_init(void)
 {
        omap_hwmod_for_each_by_class("mcbsp", omap_init_mcbsp, NULL);
 
        mcbsp_ptr = kzalloc(omap_mcbsp_count * sizeof(struct omap_mcbsp *),
                                                                GFP_KERNEL);



which sets a field in pdata after it has been freed.

commit 7bc0c4bac72375517d904e02c46da2a23e079e8b
Author: Jarkko Nikula <jarkko.nikula@...mer.com>
Date:   Mon Sep 26 10:45:49 2011 +0300


then adds

@@ -181,6 +184,8 @@ static int omap_init_mcbsp(struct omap_hwmod *oh, void *unused)
                return PTR_ERR(pdev);
        }
        pdata->set_clk_src = omap2_mcbsp_set_clk_src;
+       if (id == 1)
+               pdata->mux_signal = omap2_mcbsp1_mux_rx_clk;
        omap_mcbsp_count++;
        return 0;
 }


which sets another field.

Should these settings just be moved up before the call to
omap_device_build_ss?? Doing that removes 
[    0.196014] Slab corruption: size-32 start=ded3edc0, len=32
warning.

Thanks,
NeilBrown

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)