linux-kernel - Re: [PATCH] iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+U=DsrHSwaiS7mT4rcHT_ZQwfPg+-Hwm-jkib11+m7W-VA_FQ@mail.gmail.com>
Date:   Tue, 12 Oct 2021 14:36:55 +0300
From:   Alexandru Ardelean <ardeleanalex@...il.com>
To:     Yang Yingliang <yangyingliang@...wei.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        linux-iio <linux-iio@...r.kernel.org>,
        Lars-Peter Clausen <lars@...afoo.de>,
        Jonathan Cameron <jic23@...nel.org>,
        Andy Shevchenko <andy.shevchenko@...il.com>
Subject: Re: [PATCH] iio: buffer: Fix double-free in iio_buffers_alloc_sysfs_and_mask()

On Tue, Oct 12, 2021 at 12:18 PM Yang Yingliang
<yangyingliang@...wei.com> wrote:
>
> When __iio_buffer_alloc_sysfs_and_mask() failed, 'unwind_idx' should be
> set to 'i - 1' to prevent double-free when cleanup resources.
>
> BUG: KASAN: double-free or invalid-free in __iio_buffer_free_sysfs_and_mask+0x32/0xb0 [industrialio]
> Call Trace:
>  kfree+0x117/0x4c0
>  __iio_buffer_free_sysfs_and_mask+0x32/0xb0 [industrialio]
>  iio_buffers_alloc_sysfs_and_mask+0x60d/0x1570 [industrialio]
>  __iio_device_register+0x483/0x1a30 [industrialio]
>  ina2xx_probe+0x625/0x980 [ina2xx_adc]
>

Makes sense.
Thanks for the catch.

Reviewed-by: Alexandru Ardelean <ardeleanalex@...il.com>

> Reported-by: Hulk Robot <hulkci@...wei.com>
> Fixes: ee708e6baacd ("iio: buffer: introduce support for attaching more IIO buffers")
> Signed-off-by: Yang Yingliang <yangyingliang@...wei.com>
> ---
>  drivers/iio/industrialio-buffer.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> index a95cc2da56be..5f4bd0b73d03 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -1616,7 +1616,7 @@ int iio_buffers_alloc_sysfs_and_mask(struct iio_dev *indio_dev)
>                 buffer = iio_dev_opaque->attached_buffers[i];
>                 ret = __iio_buffer_alloc_sysfs_and_mask(buffer, indio_dev, i);
>                 if (ret) {
> -                       unwind_idx = i;
> +                       unwind_idx = i - 1;
>                         goto error_unwind_sysfs_and_mask;
>                 }
>         }
> --
> 2.25.1
>