linux-kernel - Re: [PATCH v2] ASoC: Intel: Skylake: prevent memory leak in snd_skl_parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 25 Sep 2019 12:05:28 -0500
From:   Pierre-Louis Bossart <pierre-louis.bossart@...ux.intel.com>
To:     Navid Emamdoost <navid.emamdoost@...il.com>
Cc:     emamd001@....edu, smccaman@....edu, kjlu@....edu,
        Cezary Rojewski <cezary.rojewski@...el.com>,
        Liam Girdwood <liam.r.girdwood@...ux.intel.com>,
        Jie Yang <yang.jie@...ux.intel.com>,
        Mark Brown <broonie@...nel.org>,
        Jaroslav Kysela <perex@...ex.cz>,
        Takashi Iwai <tiwai@...e.com>, Enrico Weigelt <info@...ux.net>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        alsa-devel@...a-project.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] ASoC: Intel: Skylake: prevent memory leak in
 snd_skl_parse_uuids

On 9/25/19 11:19 AM, Navid Emamdoost wrote:
> In snd_skl_parse_uuids if allocation for module->instance_id fails, the
> allocated memory for module shoulde be released. I changes the
> allocation for module to use devm_kzalloc to be resource_managed
> allocation and avoid the release in error path.

if you use devm_, don't you need to fix the error path as well then, I 
see a kfree(uuid) in skl_freeup_uuid_list().

I am not very familiar with this code but the error seems to be that the 
list_add_tail() is called after the module->instance_id is allocated, so 
there is a risk that the module allocated earlier is not freed (since 
it's not yet added to the list). Freeing the module as done in patch 1 
works, using devm_ without fixing the error path does not seem correct 
to me.

> 
> Signed-off-by: Navid Emamdoost <navid.emamdoost@...il.com>
> ---
> Changes in v2:
> 	- Changed the allocation for module from kzalloc to devm_kzalloc
> ---
>   sound/soc/intel/skylake/skl-sst-utils.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/sound/soc/intel/skylake/skl-sst-utils.c b/sound/soc/intel/skylake/skl-sst-utils.c
> index d43cbf4a71ef..ac37f04b0eea 100644
> --- a/sound/soc/intel/skylake/skl-sst-utils.c
> +++ b/sound/soc/intel/skylake/skl-sst-utils.c
> @@ -284,7 +284,7 @@ int snd_skl_parse_uuids(struct sst_dsp *ctx, const struct firmware *fw,
>   	 */
>   
>   	for (i = 0; i < num_entry; i++, mod_entry++) {
> -		module = kzalloc(sizeof(*module), GFP_KERNEL);
> +		module = devm_kzalloc(ctx->dev, sizeof(*module), GFP_KERNEL);
>   		if (!module) {
>   			ret = -ENOMEM;
>   			goto free_uuid_list;
>