linux-kernel - Re: [PATCH] serial/sunsu: add missing of_node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 02 Dec 2018 20:57:52 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     tiny.windzz@...il.com
Cc:     gregkh@...uxfoundation.org, jslaby@...e.com,
        sparclinux@...r.kernel.org, linux-serial@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] serial/sunsu: add missing of_node_put()

From: Yangtao Li <tiny.windzz@...il.com>
Date: Wed, 21 Nov 2018 11:06:15 -0500

> of_find_node_by_path() acquires a reference to the node
> returned by it and that reference needs to be dropped by its caller.
> This place is not doing this, so fix it.
> 
> Signed-off-by: Yangtao Li <tiny.windzz@...il.com>

Several coding style problems and you are adding two new
leaks.

> +		struct device_node *tmp;
>  		const char *keyb = of_get_property(ap, "keyboard", NULL);
>  		const char *ms = of_get_property(ap, "mouse", NULL);

Always order local variable declarations from longest to
shortest line.

>  
>  		if (keyb) {
> -			if (dp == of_find_node_by_path(keyb))
> -				return SU_PORT_KBD;
> +			tmp = of_find_node_by_path(keyb);
> +			if (tmp && dp == tmp){

Always put a space between ")" and the "{" openning a new basic
block.

> +				rc = SU_PORT_KBD;
> +				goto out;
> +			}
>  		}
>  		if (ms) {
> -			if (dp == of_find_node_by_path(ms))
> -				return SU_PORT_MS;
> +			tmp = of_find_node_by_path(ms);
> +			if (tmp && dp == tmp){
> +				rc = SU_PORT_MS;
> +				goto out;
> +			}
>  		}
>  	}
>  
> -	return SU_PORT_PORT;
> +out:
> +	of_node_put(ap);
> +	return rc;

Now you have two references, one held by 'ap' and one held by 'tmp'.

You are not releasing the one held by 'tmp', and you must release
'tmp' even if it equals 'dp'.

It's pretty obvious you have no way by which to test these changes and
therefore are not doing so.