linux-kernel - [PATCH v2] staging: mt29f_spinand: fix memory leak while programming pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1533196290-9669-1-git-send-email-goodwater.wu@gmail.com>
Date:   Thu,  2 Aug 2018 15:51:30 +0800
From:   Jheng-Jhong Wu <goodwater.wu@...il.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     goodwater.wu@...il.com,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org
Subject: [PATCH v2] staging: mt29f_spinand: fix memory leak while programming pages

In spinand_program_page(), it uses devm_kzalloc() to allocate memory to
wbuf dynamically if internal ECC is on, but it doesn't free memory
allocated to wbuf at the end of this function. Before the spinand device
is removed and frees memory automatically, programming pages may run many
times. This leads to a memory leak issue when internal ECC is on.

Changelog:

v2:
- use kzalloc()/kfree() to replace devm_kzalloc()/devm_kfree()
- add some descriptions to commit message

Signed-off-by: Jheng-Jhong Wu <goodwater.wu@...il.com>
---
 drivers/staging/mt29f_spinand/mt29f_spinand.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/mt29f_spinand/mt29f_spinand.c b/drivers/staging/mt29f_spinand/mt29f_spinand.c
index e389009..d740c76 100644
--- a/drivers/staging/mt29f_spinand/mt29f_spinand.c
+++ b/drivers/staging/mt29f_spinand/mt29f_spinand.c
@@ -492,7 +492,7 @@ static int spinand_program_page(struct spi_device *spi_nand,
 #ifdef CONFIG_MTD_SPINAND_ONDIEECC
 	unsigned int i, j;
 
-	wbuf = devm_kzalloc(&spi_nand->dev, CACHE_BUF, GFP_KERNEL);
+	wbuf = kzalloc(CACHE_BUF, GFP_KERNEL);
 	if (!wbuf)
 		return -ENOMEM;
 
@@ -553,6 +553,8 @@ static int spinand_program_page(struct spi_device *spi_nand,
 		}
 		enable_hw_ecc = 0;
 	}
+
+	kfree(wbuf);
 #endif
 
 	return 0;
-- 
2.7.4