linux-kernel - Re: [PATCH v3] nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <12edae35-a927-11bf-f80a-037011c4f07a@linaro.org>
Date:   Fri, 25 Sep 2020 10:32:42 +0100
From:   Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
To:     Vadym Kochan <vadym.kochan@...ision.eu>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] nvmem: core: fix possibly memleak when use
 nvmem_cell_info_to_nvmem_cell()



On 23/09/2020 21:44, Vadym Kochan wrote:
> Fix missing 'kfree_const(cell->name)' when call to
> nvmem_cell_info_to_nvmem_cell() in several places:
> 
>       * after nvmem_cell_info_to_nvmem_cell() failed during
>         nvmem_add_cells()
> 
>       * during nvmem_device_cell_{read,write} when cell->name is
>         kstrdup'ed() without calling kfree_const() at the end, but
>         really there is no reason to do that 'dup, because the cell
>         instance is allocated on the stack for some short period to be
>         read/write without exposing it to the caller.
> 
> So the new nvmem_cell_info_to_nvmem_cell_nodup() helper is introduced
> which is used to convert cell_info -> cell without name duplication as
> a lighweight version of nvmem_cell_info_to_nvmem_cell().
> 
> Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")
> Signed-off-by: Vadym Kochan <vadym.kochan@...ision.eu>

Looks good to me! Thanks for the patch.

Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@...aro.org>
Acked-by: Srinivas Kandagatla <srinivas.kandagatla@...aro.org>

Greg,

Can you please pick this one? As don't have any nvmem pending patches to 
send it together.

thanks,
srini


> ---
> v3:
>      * rename __nvmem_cell_info_to_nvmem_cell() -> nvmem_cell_info_to_nvmem_cell_nodup()
> 
>      * rephrase commit description a bit
> 
>      * get rid of wrong func line wrapping
> 
> v2:
>      * remove not needed 'kfree_const(cell->name)' after nvmem_cell_info_to_nvmem_cell()
>        failed.
> 
>   drivers/nvmem/core.c | 33 ++++++++++++++++++++++++---------
>   1 file changed, 24 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
> index 6cd3edb2eaf6..10cd935cf30e 100644
> --- a/drivers/nvmem/core.c
> +++ b/drivers/nvmem/core.c
> @@ -361,16 +361,14 @@ static void nvmem_cell_add(struct nvmem_cell *cell)
>   	blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_ADD, cell);
>   }
>   
> -static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> -				   const struct nvmem_cell_info *info,
> -				   struct nvmem_cell *cell)
> +static int nvmem_cell_info_to_nvmem_cell_nodup(struct nvmem_device *nvmem,
> +					const struct nvmem_cell_info *info,
> +					struct nvmem_cell *cell)
>   {
>   	cell->nvmem = nvmem;
>   	cell->offset = info->offset;
>   	cell->bytes = info->bytes;
> -	cell->name = kstrdup_const(info->name, GFP_KERNEL);
> -	if (!cell->name)
> -		return -ENOMEM;
> +	cell->name = info->name;
>   
>   	cell->bit_offset = info->bit_offset;
>   	cell->nbits = info->nbits;
> @@ -382,13 +380,30 @@ static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
>   	if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
>   		dev_err(&nvmem->dev,
>   			"cell %s unaligned to nvmem stride %d\n",
> -			cell->name, nvmem->stride);
> +			cell->name ?: "<unknown>", nvmem->stride);
>   		return -EINVAL;
>   	}
>   
>   	return 0;
>   }
>   
> +static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> +				const struct nvmem_cell_info *info,
> +				struct nvmem_cell *cell)
> +{
> +	int err;
> +
> +	err = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, cell);
> +	if (err)
> +		return err;
> +
> +	cell->name = kstrdup_const(info->name, GFP_KERNEL);
> +	if (!cell->name)
> +		return -ENOMEM;
> +
> +	return 0;
> +}
> +
>   /**
>    * nvmem_add_cells() - Add cell information to an nvmem device
>    *
> @@ -1460,7 +1475,7 @@ ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem,
>   	if (!nvmem)
>   		return -EINVAL;
>   
> -	rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> +	rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);
>   	if (rc)
>   		return rc;
>   
> @@ -1490,7 +1505,7 @@ int nvmem_device_cell_write(struct nvmem_device *nvmem,
>   	if (!nvmem)
>   		return -EINVAL;
>   
> -	rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);
> +	rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);
>   	if (rc)
>   		return rc;
>   
>