linux-kernel - Re: [PATCH] staging: greybus: audio: Add missing unlock in gbaudio_dapm_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Dec 2020 09:40:40 +0100
From:   Johan Hovold <johan@...nel.org>
To:     Wang Hai <wanghai38@...wei.com>,
        Vaibhav Agarwal <vaibhav.sr@...il.com>
Cc:     johan@...nel.org, elder@...nel.org, gregkh@...uxfoundation.org,
        dan.carpenter@...cle.com, aibhav.sr@...il.com,
        greybus-dev@...ts.linaro.org, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] staging: greybus: audio: Add missing unlock in
 gbaudio_dapm_free_controls()

On Fri, Dec 04, 2020 at 10:13:50AM +0800, Wang Hai wrote:
> Add the missing unlock before return from function
> gbaudio_dapm_free_controls() in the error handling case.
> 
> Fixes: 510e340efe0c ("staging: greybus: audio: Add helper APIs for dynamic audio module")
> Reported-by: Hulk Robot <hulkci@...wei.com>
> Signed-off-by: Wang Hai <wanghai38@...wei.com>
> ---
>  drivers/staging/greybus/audio_helper.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/staging/greybus/audio_helper.c b/drivers/staging/greybus/audio_helper.c
> index 237531ba60f3..293675dbea10 100644
> --- a/drivers/staging/greybus/audio_helper.c
> +++ b/drivers/staging/greybus/audio_helper.c
> @@ -135,6 +135,7 @@ int gbaudio_dapm_free_controls(struct snd_soc_dapm_context *dapm,
>  		if (!w) {
>  			dev_err(dapm->dev, "%s: widget not found\n",
>  				widget->name);
> +			mutex_unlock(&dapm->card->dapm_mutex);
>  			return -EINVAL;
>  		}
>  		widget++;

This superficially looks correct, but there seems to be another bug in
this function. It can be used free an array of widgets, but if one of
them isn't found we just leak the rest. Perhaps that return should
rather be "widget++; continue;".

Vaibhav?

Johan