linux-kernel - Re: [PATCH] clk: bcm2835: Fix memory leak in bcm2835_register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 10 Oct 2019 09:07:31 +0200
From:   Alexander Stein <alexander.stein@...lbox.org>
To:     Navid Emamdoost <navid.emamdoost@...il.com>
Cc:     emamd001@....edu, kjlu@....edu, smccaman@....edu,
        Michael Turquette <mturquette@...libre.com>,
        Stephen Boyd <sboyd@...nel.org>,
        Florian Fainelli <f.fainelli@...il.com>,
        Ray Jui <rjui@...adcom.com>,
        Scott Branden <sbranden@...adcom.com>,
        bcm-kernel-feedback-list@...adcom.com,
        Eric Anholt <eric@...olt.net>,
        Stefan Wahren <wahrenst@....net>,
        Matthias Brugger <mbrugger@...e.com>,
        Max Filippov <jcmvbkbc@...il.com>,
        Nicolas Saenz Julienne <nsaenzjulienne@...e.de>,
        linux-clk@...r.kernel.org, linux-rpi-kernel@...ts.infradead.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] clk: bcm2835: Fix memory leak in bcm2835_register_pll

Hello,

On Thursday, October 10, 2019, 3:30:58 AM CEST Navid Emamdoost wrote:
> In the implementation of bcm2835_register_pll(), the allocated memory
> for pll should be released if devm_clk_hw_register() fails.
> 
> Fixes: b19f009d4510 ("clk: bcm2835: Migrate to clk_hw based registration and OF APIs")
> Signed-off-by: Navid Emamdoost <navid.emamdoost@...il.com>
> ---
>  drivers/clk/bcm/clk-bcm2835.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
> index 802e488fd3c3..99549642110a 100644
> --- a/drivers/clk/bcm/clk-bcm2835.c
> +++ b/drivers/clk/bcm/clk-bcm2835.c
> @@ -1320,8 +1320,10 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
>  	pll->hw.init = &init;
>  
>  	ret = devm_clk_hw_register(cprman->dev, &pll->hw);
> -	if (ret)
> +	if (ret) {
> +		kfree(pll);
>  		return NULL;
> +	}
>  	return &pll->hw;
>  }

Eh, is pll freed at all, even in successful case? I failed to find a corresponding kfree().
The pointer itself is lost once the function returns.
The solution would rather be to use devm_kzalloc instead of kzalloc, like the other clocks
in e.g. bcm2835_register_pll()

Best regards,
Alexander