linux-kernel - Re: [PATCH] drm/edid: Fix potential memory leak in edid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <50215817.6070009@osadl.org>
Date:	Tue, 07 Aug 2012 20:01:59 +0200
From:	Carsten Emde <C.Emde@...dl.org>
To:	Alexey Khoroshilov <khoroshilov@...ras.ru>
CC:	David Airlie <airlied@...ux.ie>, dri-devel@...ts.freedesktop.org,
	linux-kernel@...r.kernel.org, ldv-project@...ras.ru
Subject: Re: [PATCH] drm/edid: Fix potential memory leak in edid_load()

On 08/07/2012 02:23 PM, Alexey Khoroshilov wrote:
> Do not leak memory by updating pointer with potentially
> NULL realloc return value.
>
> Found by Linux Driver Verification project (linuxtesting.org).
Thanks, Alexey!

Reviewed-by: Carsten Emde <C.Emde@...dl.org>

> Signed-off-by: Alexey Khoroshilov <khoroshilov@...ras.ru>
> ---
>   drivers/gpu/drm/drm_edid_load.c |    8 +++++---
>   1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_edid_load.c b/drivers/gpu/drm/drm_edid_load.c
> index 66d4a28..0303935 100644
> --- a/drivers/gpu/drm/drm_edid_load.c
> +++ b/drivers/gpu/drm/drm_edid_load.c
> @@ -119,7 +119,7 @@ static int edid_load(struct drm_connector *connector, char *name,
>   {
>   	const struct firmware *fw;
>   	struct platform_device *pdev;
> -	u8 *fwdata = NULL, *edid;
> +	u8 *fwdata = NULL, *edid, *new_edid;
>   	int fwsize, expected;
>   	int builtin = 0, err = 0;
>   	int i, valid_extensions = 0;
> @@ -195,12 +195,14 @@ static int edid_load(struct drm_connector *connector, char *name,
>   		    "\"%s\" for connector \"%s\"\n", valid_extensions,
>   		    edid[0x7e], name, connector_name);
>   		edid[0x7e] = valid_extensions;
> -		edid = krealloc(edid, (valid_extensions + 1) * EDID_LENGTH,
> +		new_edid = krealloc(edid, (valid_extensions + 1) * EDID_LENGTH,
>   		    GFP_KERNEL);
> -		if (edid == NULL) {
> +		if (new_edid == NULL) {
>   			err = -ENOMEM;
> +			kfree(edid);
>   			goto relfw_out;
>   		}
> +		edid = new_edid;
>   	}
>
>   	connector->display_info.raw_edid = edid;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/