linux-kernel - Re: [PATCH] drm/vmwgfx: Fix double free in vmw_recv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <08f19935-97fe-4c8b-ca7b-707586ed89a1@canonical.com>
Date:   Thu, 15 Aug 2019 09:38:40 +0100
From:   Colin Ian King <colin.king@...onical.com>
To:     Dan Carpenter <dan.carpenter@...cle.com>,
        VMware Graphics <linux-graphics-maintainer@...are.com>
Cc:     Thomas Hellstrom <thellstrom@...are.com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] drm/vmwgfx: Fix double free in vmw_recv_msg()

On 15/08/2019 09:30, Dan Carpenter wrote:
> We recently added a kfree() after the end of the loop:
> 
> 	if (retries == RETRIES) {
> 		kfree(reply);
> 		return -EINVAL;
> 	}
> 
> There are two problems.  First the test is wrong and because retries
> equals RETRIES if we succeed on the last iteration through the loop.
> Second if we fail on the last iteration through the loop then the kfree
> is a double free.
> 
> When you're reading this code, please note the break statement at the
> end of the while loop.  This patch changes the loop so that if it's not
> successful then "reply" is NULL and we can test for that afterward.
> 
> Fixes: 6b7c3b86f0b6 ("drm/vmwgfx: fix memory leak when too many retries have occurred")
> Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> ---
>  drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> index 59e9d05ab928..0af048d1a815 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> @@ -353,7 +353,7 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
>  				     !!(HIGH_WORD(ecx) & MESSAGE_STATUS_HB));
>  		if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) == 0) {
>  			kfree(reply);
> -
> +			reply = NULL;
>  			if ((HIGH_WORD(ebx) & MESSAGE_STATUS_CPT) != 0) {
>  				/* A checkpoint occurred. Retry. */
>  				continue;
> @@ -377,7 +377,7 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
>  
>  		if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
>  			kfree(reply);
> -
> +			reply = NULL;
>  			if ((HIGH_WORD(ecx) & MESSAGE_STATUS_CPT) != 0) {
>  				/* A checkpoint occurred. Retry. */
>  				continue;
> @@ -389,10 +389,8 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
>  		break;
>  	}
>  
> -	if (retries == RETRIES) {
> -		kfree(reply);
> +	if (!reply)
>  		return -EINVAL;
> -	}
>  
>  	*msg_len = reply_len;
>  	*msg     = reply;
> 

Dan, Thanks for fixing up my mistake.