| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20200923145107.GB16798@plvision.eu>
Date: Wed, 23 Sep 2020 17:51:07 +0300
From: Vadym Kochan <vadym.kochan@...ision.eu>
To: Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] nvmem: core: fix possibly memleak when use
nvmem_cell_info_to_nvmem_cell()
On Wed, Sep 23, 2020 at 03:47:14PM +0100, Srinivas Kandagatla wrote:
>
>
> On 23/09/2020 15:13, Vadym Kochan wrote:
> > On Wed, Sep 23, 2020 at 03:10:36PM +0100, Srinivas Kandagatla wrote:
> > >
> > >
> > > On 23/09/2020 14:53, Vadym Kochan wrote:
> > > > Fix missing 'kfree_const(cell->name)' when call to
> > > > nvmem_cell_info_to_nvmem_cell() in several places:
> > > >
> > > > * after nvmem_cell_info_to_nvmem_cell() failed during
> > > > nvmem_add_cells()
> > > >
> > > > * during nvmem_device_cell_{read,write}. This is fixed by simply
> > > > re-using info->name instead of duplicating it:
> > > >
> > > > cell->name = info->name
> > > >
> > > > Because cell->name is not used except for error message printing in case
> > > > of un-aligned access, the new __nvmem_cell_info_to_nvmem_cell() helper
> > > > was introduced.
> > > >
> > > > Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")
> > > > Signed-off-by: Vadym Kochan <vadym.kochan@...ision.eu>
> > > > ---
> > > > v2:
> > > > * remove not needed 'kfree_const(cell->name)' after nvmem_cell_info_to_nvmem_cell()
> > > > failed.
> > > >
> > > > drivers/nvmem/core.c | 35 ++++++++++++++++++++++++++---------
> > > > 1 file changed, 26 insertions(+), 9 deletions(-)
> > >
> > >
> > >
> > > Really :-)
> > >
> > But what about nvmem_device_cell_{read,write} case ?
> > In my understanding the cell is allocated on the stack but kstrdup() is
> You are right!
>
> That is the second issue where the caller outside would fail after
> successful call to nvmem_cell_info_to_nvmem_cell() .
>
> Probably we cam free it in failure cases!
> something like:
>
> ------------------------>cut<---------------------------
> diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
> index 6cd3edb2eaf6..fb1e756adcee 100644
> --- a/drivers/nvmem/core.c
> +++ b/drivers/nvmem/core.c
> @@ -383,6 +383,7 @@ static int nvmem_cell_info_to_nvmem_cell(struct
> nvmem_device *nvmem,
> dev_err(&nvmem->dev,
> "cell %s unaligned to nvmem stride %d\n",
> cell->name, nvmem->stride);
> + kfree_const(cell->name);
> return -EINVAL;
> }
>
> @@ -1465,8 +1466,10 @@ ssize_t nvmem_device_cell_read(struct nvmem_device
> *nvmem,
> return rc;
>
> rc = __nvmem_cell_read(nvmem, &cell, buf, &len);
> - if (rc)
> + if (rc) {
> + kfree_const(cell->name);
> return rc;
> + }
>
> return len;
> }
> @@ -1494,7 +1497,11 @@ int nvmem_device_cell_write(struct nvmem_device
> *nvmem,
> if (rc)
> return rc;
>
> - return nvmem_cell_write(&cell, buf, cell.bytes);
> + rc = nvmem_cell_write(&cell, buf, cell.bytes);
> + if (rc)
> + kfree_const(cell->name);
> +
> + return rc;
> }
> EXPORT_SYMBOL_GPL(nvmem_device_cell_write);
> ------------------------>cut<---------------------------
>
> --srini
>
But is it really needed to kstrdup(cell->name) for nvmem_device_cell_{read,write} ?
It is used only for log error in case the unaligned access did not
pass the check.
> > not freed in the end, or I missed something ?
> >
> > >
> > > Below change should just fix this the reported issue!
> > > ------------------------>cut<---------------------------
> > >
> > > diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
> > > index 6cd3edb2eaf6..9fb9112fe75d 100644
> > > --- a/drivers/nvmem/core.c
> > > +++ b/drivers/nvmem/core.c
> > > @@ -383,6 +383,7 @@ static int nvmem_cell_info_to_nvmem_cell(struct
> > > nvmem_device *nvmem,
> > > dev_err(&nvmem->dev,
> > > "cell %s unaligned to nvmem stride %d\n",
> > > cell->name, nvmem->stride);
> > > + kfree_const(cell->name);
> > > return -EINVAL;
> > > }
> > >
> > > ------------------------>cut<---------------------------
> > >
> > > I don't see a point in the way your patch try to fix this!!
> > >
> > >
> > > --srini
> > >
> > > >
> > > > diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
> > > > index 6cd3edb2eaf6..e6d1bc414faf 100644
> > > > --- a/drivers/nvmem/core.c
> > > > +++ b/drivers/nvmem/core.c
> > > > @@ -361,16 +361,15 @@ static void nvmem_cell_add(struct nvmem_cell *cell)
> > > > blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_ADD, cell);
> > > > }
> > > > -static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> > > > - const struct nvmem_cell_info *info,
> > > > - struct nvmem_cell *cell)
> > > > +static int
> > > > +__nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> > > > + const struct nvmem_cell_info *info,
> > > > + struct nvmem_cell *cell)
> > > > {
> > > > cell->nvmem = nvmem;
> > > > cell->offset = info->offset;
> > > > cell->bytes = info->bytes;
> > > > - cell->name = kstrdup_const(info->name, GFP_KERNEL);
> > > > - if (!cell->name)
> > > > - return -ENOMEM;
> > > > + cell->name = info->name;
> > > > cell->bit_offset = info->bit_offset;
> > > > cell->nbits = info->nbits;
> > > > @@ -382,13 +381,31 @@ static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> > > > if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
> > > > dev_err(&nvmem->dev,
> > > > "cell %s unaligned to nvmem stride %d\n",
> > > > - cell->name, nvmem->stride);
> > > > + cell->name ?: "<unknown>", nvmem->stride);
> > > > return -EINVAL;
> > > > }
> > > > return 0;
> > > > }
> > > > +static int
> > > > +nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> > > > + const struct nvmem_cell_info *info,
> > > > + struct nvmem_cell *cell)
> > > > +{
> > > > + int err;
> > > > +
> > > > + err = __nvmem_cell_info_to_nvmem_cell(nvmem, info, cell);
> > > > + if (err)
> > > > + return err;
> > > > +
> > > > + cell->name = kstrdup_const(info->name, GFP_KERNEL);
> > > > + if (!cell->name)
> > > > + return -ENOMEM;
> > > > +
> > > > + return 0;
> > > > +}
> > > > +
> > > > /**
> > > > * nvmem_add_cells() - Add cell information to an nvmem device
> > > > *
> > > > @@ -1460,7 +1477,7 @@ ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem,
> > > > if (!nvmem)
> > > > return -EINVAL;
> > > > - rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> > > > + rc = __nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> > > > if (rc)
> > > > return rc;
> > > > @@ -1490,7 +1507,7 @@ int nvmem_device_cell_write(struct nvmem_device *nvmem,
> > > > if (!nvmem)
> > > > return -EINVAL;
> > > > - rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> > > > + rc = __nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> > > > if (rc)
> > > > return rc;
> > > >
Powered by blists - more mailing lists