linux-kernel - Re: [PATCH] clk: fix a missing-free bug in clk_cpy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e5b4639b-3077-59bb-6383-0c2bccdd9191@suse.cz>
Date:   Fri, 7 Jun 2019 11:10:37 +0200
From:   Jiri Slaby <jslaby@...e.cz>
To:     Gen Zhang <blackgod016574@...il.com>,
        Stephen Boyd <sboyd@...nel.org>
Cc:     mturquette@...libre.com, linux-clk@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] clk: fix a missing-free bug in clk_cpy_name()

On 07. 06. 19, 3:52, Gen Zhang wrote:
>>>>> @@ -3491,6 +3492,8 @@ static int clk_core_populate_parent_map(struct clk_core *core)
>>>>>                             kfree_const(parents[i].name);
>>>>>                             kfree_const(parents[i].fw_name);
>>>>>                     } while (--i >= 0);
>>>>> +                   kfree_const(parent->name);
>>>>> +                   kfree_const(parent->fw_name);
>>>>
>>>> Both of them were just freed in the loop above, no?
>>> for (i = 0, parent = parents; i < num_parents; i++, parent++)
>>> Is 'parent' the same as the one from the loop above?
>>
>> Yes. Did it change somehow?
> parent++?

parent++ is done after the loop body. Or what do you mean?

>>> Moreover, should 'parents[i].name' and 'parents[i].fw_name' be freed by
>>> kfree_const()?
>>>
>>
>> Yes? They're allocated with kstrdup_const() in clk_cpy_name(), or
>> they're NULL by virtue of the kcalloc and then kfree_const() does
>> nothing.
> I re-examined clk_cpy_name(). They are the second parameter of 
> clk_cpy_name(). The first parameter is allocated, not the second one.
> So 'parent->name' and 'parent->fw_name' should be freed, not 
> 'parents[i].name' or 'parents[i].fw_name'. Am I totally misunderstanding
> this clk_cpy_name()? :-(

The second parameter (the source) is parent_data[i].*, not parents[i].*
(the destination). parent->fw_name and parent->name are properly freed
in the do {} while loop as parents[i].name and parents[i].fw_name, given
i hasn't changed yet. I am not sure what you mean at all. Are you
uncertain about the C code flow?

thanks,
-- 
js
suse labs