linux-kernel - drivers/firmware/xilinx/zynqmp.c:1288 zynqmp_firmware_remove() error: dereferencing freed memory 'feature

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 11 Jan 2021 13:43:10 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org,
        Amit Sunil Dhamne <amit.sunil.dhamne@...inx.com>
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        linux-kernel@...r.kernel.org, Michal Simek <monstr@...str.eu>,
        Ravi Patel <ravi.patel@...inx.com>,
        Rajan Vaja <rajan.vaja@...inx.com>,
        Arnd Bergmann <arnd@...db.de>
Subject: drivers/firmware/xilinx/zynqmp.c:1288 zynqmp_firmware_remove()
 error: dereferencing freed memory 'feature_data'

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   f5e6c330254ae691f6d7befe61c786eb5056007e
commit: acfdd18591eaac25446e976a0c0d190f8b3dbfb1 firmware: xilinx: Use hash-table for api feature check
config: arm64-randconfig-m031-20210108 (attached as .config)
compiler: aarch64-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

smatch warnings:
drivers/firmware/xilinx/zynqmp.c:1288 zynqmp_firmware_remove() error: dereferencing freed memory 'feature_data'

vim +/feature_data +1288 drivers/firmware/xilinx/zynqmp.c

76582671eb5d006 Rajan Vaja        2018-09-12  1280  static int zynqmp_firmware_remove(struct platform_device *pdev)
76582671eb5d006 Rajan Vaja        2018-09-12  1281  {
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1282  	struct pm_api_feature_data *feature_data;
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1283  	int i;
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1284  
e23d9c6d0d4912f Jolly Shah        2019-02-01  1285  	mfd_remove_devices(&pdev->dev);
b321725257c1733 Rajan Vaja        2018-09-12  1286  	zynqmp_pm_api_debugfs_exit();
b321725257c1733 Rajan Vaja        2018-09-12  1287  
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23 @1288  	hash_for_each(pm_api_features_map, i, feature_data, hentry) {

This has to use hash_for_each_safe().

acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1289  		hash_del(&feature_data->hentry);
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1290  		kfree(feature_data);
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1291  	}
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1292  
76582671eb5d006 Rajan Vaja        2018-09-12  1293  	return 0;
76582671eb5d006 Rajan Vaja        2018-09-12  1294  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

Download attachment ".config.gz" of type "application/gzip" (31707 bytes)