linux-kernel - [PATCH] regmap: Properly free allocated name for regmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201109115816.160639-1-wangkefeng.wang@huawei.com>
Date:   Mon, 9 Nov 2020 19:58:16 +0800
From:   Kefeng Wang <wangkefeng.wang@...wei.com>
To:     Mark Brown <broonie@...nel.org>
CC:     Marc Zyngier <maz@...nel.org>, <linux-kernel@...r.kernel.org>,
        Kefeng Wang <wangkefeng.wang@...wei.com>
Subject: [PATCH] regmap: Properly free allocated name for regmap_config of syscon

syscon_config.name in of_syscon_register is allocated using kasprintf,
which should be freed when it is not used after regmap_set_name, fix
the following memory leak.

unreferenced object 0xffffffe07fe8c150 (size 16):
  comm "swapper/0", pid 1, jiffies 4294892540 (age 68.168s)
  hex dump (first 16 bytes):
    74 65 73 74 40 31 30 30 30 30 30 00 e0 ff ff ff  test@...000.....
  backtrace:
    [<0000000023d86736>] create_object+0xe8/0x348
    [<00000000fe9d1b17>] kmemleak_alloc+0x20/0x2a
    [<000000006bba3c96>] __kmalloc_track_caller+0x174/0x272
    [<000000008bbb1565>] kvasprintf+0x42/0x86
    [<000000000e566920>] kasprintf+0x34/0x50
    [<00000000809602dd>] of_syscon_register+0x11c/0x2a8
    [<00000000711191ee>] device_node_get_regmap+0x6a/0x98
    [<0000000083dd951c>] syscon_node_to_regmap+0x2e/0x38
    [<00000000cbe0596d>] syscon_regmap_lookup_by_phandle+0x1e/0x26
    [<000000009d9c679f>] syscon_reboot_probe+0x58/0x1aa
    [<000000007b610fab>] platform_drv_probe+0x30/0x64
    [<0000000031597f78>] really_probe+0x9c/0x274
    [<000000004d1de808>] driver_probe_device+0x2c/0x68
    [<000000008a998a90>] device_driver_attach+0x4c/0x50
    [<000000002ea43ad9>] __driver_attach+0x66/0xa0
    [<0000000018505756>] bus_for_each_dev+0x5a/0x98

Fixes: 529a1101212a ("mfd: syscon: Don't free allocated name for regmap_config")
Signed-off-by: Kefeng Wang <wangkefeng.wang@...wei.com>
---
 drivers/base/regmap/regmap.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 5db536ccfcd6..c1c1e53d46ac 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -601,6 +601,7 @@ static int regmap_set_name(struct regmap *map, const struct regmap_config *confi
 		if (!name)
 			return -ENOMEM;
 
+		kfree_const(config->name);
 		kfree_const(map->name);
 		map->name = name;
 	}
-- 
2.26.2