linux-kernel - [PATCH 3/3] kconfig: Fix choice symbol expression leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1507484146-23617-4-git-send-email-ulfalizer@gmail.com>
Date:   Sun,  8 Oct 2017 19:35:46 +0200
From:   Ulf Magnusson <ulfalizer@...il.com>
To:     yann.morin.1998@...e.fr, linux-kbuild@...r.kernel.org
Cc:     sam@...nborg.org, zippel@...ux-m68k.org, nicolas.pitre@...aro.org,
        michal.lkml@...kovi.net, dirk@...ders.net,
        yamada.masahiro@...ionext.com, lacombar@...il.com,
        walch.martin@....de, JBeulich@...e.com,
        linux-kernel@...r.kernel.org, Ulf Magnusson <ulfalizer@...il.com>
Subject: [PATCH 3/3] kconfig: Fix choice symbol expression leak

When propagating dependencies from parents after parsing, an expression
node is allocated if the parent symbol is a 'choice'. This node was
never freed.

Outline of leak:

	if (sym && sym_is_choice(sym)) {
		...
		*Allocate (in this case only)*
		parentdep = expr_alloc_symbol(sym);
	} else if (parent->prompt)
		parentdep = parent->prompt->visible.expr;
	else
		parentdep = parent->dep;

	for (menu = parent->list; menu; menu = menu->next) {
		...
		*Copy*
		basedep = expr_alloc_and(expr_copy(parentdep), basedep);
		...
	}
	*parentdep lost if the parent is a choice!*

Fix by freeing 'parentdep' after the loop if the parent symbol is a
choice. Note that this only frees the expression node and not the choice
symbol itself.

Summary from Valgrind on 'menuconfig' (ARCH=x86) before the fix:

	LEAK SUMMARY:
	   definitely lost: 1,608 bytes in 67 blocks
	   ...

Summary after the fix:

	LEAK SUMMARY:
	   definitely lost: 0 bytes in 0 blocks
	   ...

Signed-off-by: Ulf Magnusson <ulfalizer@...il.com>
---
 scripts/kconfig/menu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 749c2bd..e0badd9 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -344,6 +344,10 @@ void menu_finalize(struct menu *parent)
 				}
 			}
 		}
+
+		if (sym && sym_is_choice(sym))
+			expr_free(parentdep);
+
 		for (menu = parent->list; menu; menu = menu->next)
 			menu_finalize(menu);
 	} else if (sym) {
-- 
2.7.4