linux-kernel - Re: [Patch] hdac_sysfs: Fix a memory leaking bug in sound/hda/hdac

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190516085957.GA3107@zhanggen-UX430UQ>
Date:   Thu, 16 May 2019 16:59:57 +0800
From:   Gen Zhang <blackgod016574@...il.com>
To:     Takashi Iwai <tiwai@...e.de>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [Patch] hdac_sysfs: Fix a memory leaking bug in
 sound/hda/hdac_sysfs.c file of Linux 5.1

On Thu, May 16, 2019 at 10:49:43AM +0200, Takashi Iwai wrote:
> On Thu, 16 May 2019 10:40:03 +0200,
> Gen Zhang wrote:
> > 
> > tree->root and tree->nodes are allocated by memory allocation 
> > functions. And tree is also an allocated memory. When allocation of 
> > tree->root and tree->nodes fails, not freeing tree will leak memory. 
> > Thus we should free tree in this situation.
> 
> No, the leftover is freed in the caller side by calling
> widget_tree_free().
> 
> 
> thanks,
> 
> Takashi
> 
> > 
> > Signed-off-by: Gen Zhang <blackgod016574@...il.com>
> > 
> > ---
> > diff --git a/sound/hda/hdac_sysfs.c b/sound/hda/hdac_sysfs.c
> > index fb2aa34..5d8a939 100644
> > --- a/sound/hda/hdac_sysfs.c
> > +++ b/sound/hda/hdac_sysfs.c
> > @@ -370,12 +370,12 @@ static int widget_tree_create(struct hdac_device *codec)
> >  
> >  	tree->root = kobject_create_and_add("widgets", &codec->dev.kobj);
> >  	if (!tree->root)
> > -		return -ENOMEM;
> > +		goto free_tree;
> >  
> >  	tree->nodes = kcalloc(codec->num_nodes + 1, sizeof(*tree->nodes),
> >  			      GFP_KERNEL);
> >  	if (!tree->nodes)
> > -		return -ENOMEM;
> > +		goto free_tree;
> >  
> >  	for (i = 0, nid = codec->start_nid; i < codec->num_nodes; i++, nid++) {
> >  		err = add_widget_node(tree->root, nid, &widget_node_group,
> > @@ -393,6 +393,9 @@ static int widget_tree_create(struct hdac_device *codec)
> >  
> >  	kobject_uevent(tree->root, KOBJ_CHANGE);
> >  	return 0;
> > +free_tree:
> > +	kfree(tree);
> > +	return -ENOMEM;
> >  }
> >  
> >  int hda_widget_sysfs_init(struct hdac_device *codec)
> > ---
> > 
It is freed in the caller site :)
But it is really a rare free usage.
Thanks
Gen