linux-kernel - Re: [PATCH] drm/vmwgfx: Fix double free in vmw_recv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 5 Sep 2019 11:54:46 +0000
From:   Thomas Hellstrom <thellstrom@...are.com>
To:     "colin.king@...onical.com" <colin.king@...onical.com>,
        "dan.carpenter@...cle.com" <dan.carpenter@...cle.com>,
        Linux-graphics-maintainer <Linux-graphics-maintainer@...are.com>
CC:     "daniel@...ll.ch" <daniel@...ll.ch>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "airlied@...ux.ie" <airlied@...ux.ie>,
        "kernel-janitors@...r.kernel.org" <kernel-janitors@...r.kernel.org>
Subject: Re: [PATCH] drm/vmwgfx: Fix double free in vmw_recv_msg()

On Thu, 2019-08-15 at 09:38 +0100, Colin Ian King wrote:
> On 15/08/2019 09:30, Dan Carpenter wrote:
> > We recently added a kfree() after the end of the loop:
> > 
> > 	if (retries == RETRIES) {
> > 		kfree(reply);
> > 		return -EINVAL;
> > 	}
> > 
> > There are two problems.  First the test is wrong and because
> > retries
> > equals RETRIES if we succeed on the last iteration through the
> > loop.
> > Second if we fail on the last iteration through the loop then the
> > kfree
> > is a double free.
> > 
> > When you're reading this code, please note the break statement at
> > the
> > end of the while loop.  This patch changes the loop so that if it's
> > not
> > successful then "reply" is NULL and we can test for that afterward.
> > 
> > Fixes: 6b7c3b86f0b6 ("drm/vmwgfx: fix memory leak when too many
> > retries have occurred")
> > Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> > ---
> >  drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 8 +++-----
> >  1 file changed, 3 insertions(+), 5 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> > b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> > index 59e9d05ab928..0af048d1a815 100644
> > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> > @@ -353,7 +353,7 @@ static int vmw_recv_msg(struct rpc_channel
> > *channel, void **msg,
> >  				     !!(HIGH_WORD(ecx) &
> > MESSAGE_STATUS_HB));
> >  		if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) == 0) {
> >  			kfree(reply);
> > -
> > +			reply = NULL;
> >  			if ((HIGH_WORD(ebx) & MESSAGE_STATUS_CPT) != 0)
> > {
> >  				/* A checkpoint occurred. Retry. */
> >  				continue;
> > @@ -377,7 +377,7 @@ static int vmw_recv_msg(struct rpc_channel
> > *channel, void **msg,
> >  
> >  		if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
> >  			kfree(reply);
> > -
> > +			reply = NULL;
> >  			if ((HIGH_WORD(ecx) & MESSAGE_STATUS_CPT) != 0)
> > {
> >  				/* A checkpoint occurred. Retry. */
> >  				continue;
> > @@ -389,10 +389,8 @@ static int vmw_recv_msg(struct rpc_channel
> > *channel, void **msg,
> >  		break;
> >  	}
> >  
> > -	if (retries == RETRIES) {
> > -		kfree(reply);
> > +	if (!reply)
> >  		return -EINVAL;
> > -	}
> >  
> >  	*msg_len = reply_len;
> >  	*msg     = reply;
> > 
> 
> Dan, Thanks for fixing up my mistake.

Thanks, Dan. Sorry for the late reply. 
Reviewed-by: Thomas Hellström <thellstrom@...are.com>
Will push this to fixes.

/Thomas