linux-kernel - Re: [PATCH] lpss8250_dma_setup: there is memory leak when second allocation fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 20 Jul 2019 01:35:51 +0300
From:   Andy Shevchenko <andy.shevchenko@...il.com>
To:     Navid Emamdoost <navid.emamdoost@...il.com>
Cc:     emamd001@....edu, Kangjie Lu <kjlu@....edu>, smccaman@....edu,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jiri Slaby <jslaby@...e.com>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Vinod Koul <vkoul@...nel.org>,
        "open list:SERIAL DRIVERS" <linux-serial@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] lpss8250_dma_setup: there is memory leak when second
 allocation fails

On Sat, Jul 20, 2019 at 1:23 AM Navid Emamdoost
<navid.emamdoost@...il.com> wrote:
>
> in lpss8250_dma_setup, we need to release the first dma slave object
> allocated in case of the second allocation failure.
>

This will bring a double free instead of fixing anything.

NAK.

> Signed-off-by: Navid Emamdoost <navid.emamdoost@...il.com>
> ---
>  drivers/tty/serial/8250/8250_lpss.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/tty/serial/8250/8250_lpss.c b/drivers/tty/serial/8250/8250_lpss.c
> index d07e431110d9..6e1f86db88b2 100644
> --- a/drivers/tty/serial/8250/8250_lpss.c
> +++ b/drivers/tty/serial/8250/8250_lpss.c
> @@ -259,8 +259,10 @@ static int lpss8250_dma_setup(struct lpss8250 *lpss, struct uart_8250_port *port
>                 return -ENOMEM;
>
>         tx_param = devm_kzalloc(dev, sizeof(*tx_param), GFP_KERNEL);
> -       if (!tx_param)
> +       if (!tx_param) {
> +               kfree(rx_param);
>                 return -ENOMEM;
> +       }
>
>         *rx_param = lpss->dma_param;
>         dma->rxconf.src_maxburst = lpss->dma_maxburst;
> --
> 2.17.1
>


-- 
With Best Regards,
Andy Shevchenko