linux-kernel - Re: [PATCH v2] nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 23 Sep 2020 17:13:34 +0300
From:   Vadym Kochan <vadym.kochan@...ision.eu>
To:     Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] nvmem: core: fix possibly memleak when use
 nvmem_cell_info_to_nvmem_cell()

On Wed, Sep 23, 2020 at 03:10:36PM +0100, Srinivas Kandagatla wrote:
> 
> 
> On 23/09/2020 14:53, Vadym Kochan wrote:
> > Fix missing 'kfree_const(cell->name)' when call to
> > nvmem_cell_info_to_nvmem_cell() in several places:
> > 
> >       * after nvmem_cell_info_to_nvmem_cell() failed during
> >         nvmem_add_cells()
> > 
> >       * during nvmem_device_cell_{read,write}. This is fixed by simply
> >         re-using info->name instead of duplicating it:
> > 
> >             cell->name = info->name
> > 
> > Because cell->name is not used except for error message printing in case
> > of un-aligned access, the new __nvmem_cell_info_to_nvmem_cell() helper
> > was introduced.
> > 
> > Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")
> > Signed-off-by: Vadym Kochan <vadym.kochan@...ision.eu>
> > ---
> > v2:
> >      * remove not needed 'kfree_const(cell->name)' after nvmem_cell_info_to_nvmem_cell()
> >        failed.
> > 
> >   drivers/nvmem/core.c | 35 ++++++++++++++++++++++++++---------
> >   1 file changed, 26 insertions(+), 9 deletions(-)
> 
> 
> 
> Really :-)
> 
But what about nvmem_device_cell_{read,write} case ?
In my understanding the cell is allocated on the stack but kstrdup() is
not freed in the end, or I missed something ?

> 
> Below change should just fix this the reported issue!
> ------------------------>cut<---------------------------
> 
> diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
> index 6cd3edb2eaf6..9fb9112fe75d 100644
> --- a/drivers/nvmem/core.c
> +++ b/drivers/nvmem/core.c
> @@ -383,6 +383,7 @@ static int nvmem_cell_info_to_nvmem_cell(struct
> nvmem_device *nvmem,
>                 dev_err(&nvmem->dev,
>                         "cell %s unaligned to nvmem stride %d\n",
>                         cell->name, nvmem->stride);
> +               kfree_const(cell->name);
>                 return -EINVAL;
>         }
> 
> ------------------------>cut<---------------------------
> 
> I don't see a point in the way your patch try to fix this!!
> 
> 
> --srini
> 
> > 
> > diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
> > index 6cd3edb2eaf6..e6d1bc414faf 100644
> > --- a/drivers/nvmem/core.c
> > +++ b/drivers/nvmem/core.c
> > @@ -361,16 +361,15 @@ static void nvmem_cell_add(struct nvmem_cell *cell)
> >   	blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_ADD, cell);
> >   }
> > -static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> > -				   const struct nvmem_cell_info *info,
> > -				   struct nvmem_cell *cell)
> > +static int
> > +__nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> > +				const struct nvmem_cell_info *info,
> > +				struct nvmem_cell *cell)
> >   {
> >   	cell->nvmem = nvmem;
> >   	cell->offset = info->offset;
> >   	cell->bytes = info->bytes;
> > -	cell->name = kstrdup_const(info->name, GFP_KERNEL);
> > -	if (!cell->name)
> > -		return -ENOMEM;
> > +	cell->name = info->name;
> >   	cell->bit_offset = info->bit_offset;
> >   	cell->nbits = info->nbits;
> > @@ -382,13 +381,31 @@ static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> >   	if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
> >   		dev_err(&nvmem->dev,
> >   			"cell %s unaligned to nvmem stride %d\n",
> > -			cell->name, nvmem->stride);
> > +			cell->name ?: "<unknown>", nvmem->stride);
> >   		return -EINVAL;
> >   	}
> >   	return 0;
> >   }
> > +static int
> > +nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> > +			      const struct nvmem_cell_info *info,
> > +			      struct nvmem_cell *cell)
> > +{
> > +	int err;
> > +
> > +	err = __nvmem_cell_info_to_nvmem_cell(nvmem, info, cell);
> > +	if (err)
> > +		return err;
> > +
> > +	cell->name = kstrdup_const(info->name, GFP_KERNEL);
> > +	if (!cell->name)
> > +		return -ENOMEM;
> > +
> > +	return 0;
> > +}
> > +
> >   /**
> >    * nvmem_add_cells() - Add cell information to an nvmem device
> >    *
> > @@ -1460,7 +1477,7 @@ ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem,
> >   	if (!nvmem)
> >   		return -EINVAL;
> > -	rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> > +	rc = __nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> >   	if (rc)
> >   		return rc;
> > @@ -1490,7 +1507,7 @@ int nvmem_device_cell_write(struct nvmem_device *nvmem,
> >   	if (!nvmem)
> >   		return -EINVAL;
> > -	rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> > +	rc = __nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> >   	if (rc)
> >   		return rc;
> >