linux-kernel - Re: [PATCH] tty: serial: 8250: serial_cs: Fix a memory leak in error handling path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <YJ01W4zWfG601Sbv@kroah.com>
Date:   Thu, 13 May 2021 16:19:07 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Christophe JAILLET <christophe.jaillet@...adoo.fr>
Cc:     hjk@...utronix.de, jirislaby@...nel.org, lee.jones@...aro.org,
        linux-serial@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] tty: serial: 8250: serial_cs: Fix a memory leak in error
 handling path

On Sun, May 09, 2021 at 10:28:18AM +0200, Christophe JAILLET wrote:
> In the probe function, if the final 'serial_config()' fails, 'info' is
> leaking.
> 
> Use 'devm_kzalloc' instead to fix the leak and simplify the .remove
> function.
> 
> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
> ---
> I've not been able to find a Fixes tag. All I know is that it is old!
> ---
>  drivers/tty/serial/8250/serial_cs.c | 7 +------
>  1 file changed, 1 insertion(+), 6 deletions(-)
> 
> diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c
> index 63ea9c4da3d5..d18c98e0d0b0 100644
> --- a/drivers/tty/serial/8250/serial_cs.c
> +++ b/drivers/tty/serial/8250/serial_cs.c
> @@ -310,7 +310,7 @@ static int serial_probe(struct pcmcia_device *link)
>  	dev_dbg(&link->dev, "serial_attach()\n");
>  
>  	/* Create new serial device */
> -	info = kzalloc(sizeof(*info), GFP_KERNEL);
> +	info = devm_kzalloc(&link->dev, sizeof(*info), GFP_KERNEL);

Ick, let's not mix and only use some devm_ calls here, why not just fix
it up and free it in the error path?


thanks,

greg k-h