linux-kernel - Re: [2/2] ASoC: samsung: odroid: fix a double-free issue for cpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4545ce50-493c-8faa-fdcd-5aee3ca30792@web.de>
Date:   Sun, 14 Jul 2019 14:47:18 +0200
From:   Markus Elfring <Markus.Elfring@....de>
To:     Wen Yang <wen.yang99@....com.cn>, alsa-devel@...a-project.org
Cc:     kernel-janitors@...r.kernel.org,
        LKML <linux-kernel@...r.kernel.org>,
        Cheng Shengyu <cheng.shengyu@....com.cn>,
        Jaroslav Kysela <perex@...ex.cz>,
        Krzysztof Kozlowski <krzk@...nel.org>,
        Liam Girdwood <lgirdwood@...il.com>,
        Mark Brown <broonie@...nel.org>,
        Sangbeom Kim <sbkim73@...sung.com>,
        Sylwester Nawrocki <s.nawrocki@...sung.com>,
        Takashi Iwai <tiwai@...e.com>,
        Xue Zhihong <xue.zhihong@....com.cn>,
        Yi Wang <wang.yi59@....com.cn>
Subject: Re: [2/2] ASoC: samsung: odroid: fix a double-free issue for cpu_dai

> The cpu_dai variable is still being used after the of_node_put() call,

Such an implementation detail is questionable.
https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory

> which may result in double-free:

This consequence is also undesirable.
https://cwe.mitre.org/data/definitions/415.html

Now I wonder if two update steps are really appropriate as a fix
instead of using a single update step for the desired correction
in this software module.
Should a commit (including previous ones) usually be correct by itself?

Regards,
Markus