linux-kernel - Re: [PATCH] soundwire: fix error handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 1 Sep 2020 10:41:55 -0700
From:   Nick Desaulniers <ndesaulniers@...gle.com>
To:     Vinod Koul <vkoul@...nel.org>
Cc:     Tom Rix <trix@...hat.com>, yung-chuan.liao@...ux.intel.com,
        Pierre-Louis Bossart <pierre-louis.bossart@...ux.intel.com>,
        Sanyog Kale <sanyog.r.kale@...el.com>,
        Nathan Chancellor <natechancellor@...il.com>,
        shreyas.nc@...el.com, alsa-devel@...a-project.org,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] soundwire: fix error handling

On Tue, Sep 1, 2020 at 4:02 AM Vinod Koul <vkoul@...nel.org> wrote:
>
> Hello Tom,
>
> On 29-08-20, 08:35, trix@...hat.com wrote:
> > From: Tom Rix <trix@...hat.com>
> >
> > clang static analysis flags this problem
> >
> > stream.c:844:9: warning: Use of memory after
> >   it is freed
> >         kfree(bus->defer_msg.msg->buf);
> >               ^~~~~~~~~~~~~~~~~~~~~~~
> >
> > This happens in an error handler cleaning up memory
> > allocated for elements in a list.
> >
> >       list_for_each_entry(m_rt, &stream->master_list, stream_node) {
> >               bus = m_rt->bus;
> >
> >               kfree(bus->defer_msg.msg->buf);
> >               kfree(bus->defer_msg.msg);
> >       }
> >
> > And is triggered when the call to sdw_bank_switch() fails.
> > There are a two problems.
> >
> > First, when sdw_bank_switch() fails, though it frees memory it
> > does not clear bus's reference 'defer_msg.msg' to that memory.
> >
> > The second problem is the freeing msg->buf. In some cases
> > msg will be NULL so this will dereference a null pointer.
> > Need to check before freeing.
>
> The change looks good to me, but the title of patch should be revised.
>
> The patch subject should describe the patch, in this case is setting
> pointer to null on cleanup, so an appropriate subject may be"
> "[PATCH]: soundwire: set defer_msg to null".
>
> Please revise subject line and update including the ack/reviews
> received

That's fair, I think
soundwire: fix double free of dangling pointer
would be most precise.


-- 
Thanks,
~Nick Desaulniers