linux-kernel - Re: [PATCH 4.19 111/264] nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201028220551.GA87646@sasha-vm>
Date:   Wed, 28 Oct 2020 18:05:51 -0400
From:   Sasha Levin <sashal@...nel.org>
To:     Pavel Machek <pavel@....cz>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Srinivas Kandagatla <srinivas.kandagatla@...aro.org>,
        Vadym Kochan <vadym.kochan@...ision.eu>
Subject: Re: [PATCH 4.19 111/264] nvmem: core: fix possibly memleak when use
 nvmem_cell_info_to_nvmem_cell()

On Wed, Oct 28, 2020 at 09:12:34PM +0100, Pavel Machek wrote:
>Hi!
>
>> From: Vadym Kochan <vadym.kochan@...ision.eu>
>>
>> [ Upstream commit fc9eec4d643597cf4cb2fef17d48110e677610da ]
>>
>> Fix missing 'kfree_const(cell->name)' when call to
>> nvmem_cell_info_to_nvmem_cell() in several places:
>>
>>      * after nvmem_cell_info_to_nvmem_cell() failed during
>>        nvmem_add_cells()
>>
>>      * during nvmem_device_cell_{read,write} when cell->name is
>>        kstrdup'ed() without calling kfree_const() at the end, but
>>        really there is no reason to do that 'dup, because the cell
>>        instance is allocated on the stack for some short period to be
>>        read/write without exposing it to the caller.
>>
>> So the new nvmem_cell_info_to_nvmem_cell_nodup() helper is introduced
>> which is used to convert cell_info -> cell without name duplication as
>> a lighweight version of nvmem_cell_info_to_nvmem_cell().
>>
>> Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")
>
>There's something very wrong here.

Right, looks like it actually fixes 16bb7abc4a6b ("nvmem: core: fix
memory abort in cleanup path"). I'll just drop this commit.

-- 
Thanks,
Sasha