linux-kernel - [PATCH] firmware: dmi: Fix reference count leaks.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sat, 13 Jun 2020 14:24:23 -0500
From:   wu000273@....edu
To:     kjlu@....edu
Cc:     wu000273@....edu, linux-kernel@...r.kernel.org
Subject: [PATCH] firmware: dmi: Fix reference count leaks.

From: Qiushi Wu <wu000273@....edu>

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.
Callback function dmi_sysfs_entry_release() in kobject_put()
can handle the pointer "entry" properly.

Signed-off-by: Qiushi Wu <wu000273@....edu>
---
 drivers/firmware/dmi-sysfs.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c
index b6180023eba7..9889e5ed2064 100644
--- a/drivers/firmware/dmi-sysfs.c
+++ b/drivers/firmware/dmi-sysfs.c
@@ -457,8 +457,10 @@ static int dmi_system_event_log(struct dmi_sysfs_entry *entry)
 				   &dmi_system_event_log_ktype,
 				   &entry->kobj,
 				   "system_event_log");
-	if (ret)
-		goto out_free;
+	if (ret) {
+		kobject_put(entry->child);
+		return ret;
+	}

 	ret = sysfs_create_bin_file(entry->child, &dmi_sel_raw_attr);
 	if (ret)
@@ -468,7 +470,6 @@ static int dmi_system_event_log(struct dmi_sysfs_entry *entry)

 out_del:
 	kobject_del(entry->child);
-out_free:
 	kfree(entry->child);
 	return ret;
 }
@@ -603,7 +604,7 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh,
 				    "%d-%d", dh->type, entry->instance);

 	if (*ret) {
-		kfree(entry);
+		kobject_put(&entry->kobj);
 		return;
 	}

-- 
2.17.1