linux-kernel - [PATCH] drm/selftests/test-drm_dp_mst_helper: A memleak in sideband_msg_req_encode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 30 Nov 2021 23:08:56 +0800
From:   Zhou Qingyang <zhou1615@....edu>
To:     zhou1615@....edu
Cc:     kjlu@....edu, David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        Lee Jones <lee.jones@...aro.org>,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: [PATCH] drm/selftests/test-drm_dp_mst_helper: A memleak in sideband_msg_req_encode_decode()

In test-drm_dp_mst_helper.c file, if the initialization of
txmsg fails in sideband_msg_req_encode_decode(),
this function will directly return false and forget to free
the variable out, which will lead to a possible memory leak.

Although this bug is not serious as it belongs to testing code, it is
better to be fixed to avoid unexpected behavior in testing.

I fix this bug by changing 'return false' to 'goto out'.

This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.

Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.

we build kernel with CONFIG_DRM_DEBUG_SELFTEST=m and show no warnings.
Also our static analyzer no longer warns.

Fixes:  09234b88ef55 ( "drm/selftests/test-drm_dp_mst_helper: Move 'sideband_msg_req_encode_decode' onto the heap")
Signed-off-by: Zhou Qingyang <zhou1615@....edu>
---
 drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c b/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c
index 6b4759ed6bfd..e74cea9dafc6 100644
--- a/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c
+++ b/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c
@@ -132,7 +132,7 @@ sideband_msg_req_encode_decode(struct drm_dp_sideband_msg_req_body *in)

 	txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
 	if (!txmsg)
-		return false;
+		goto out;

 	drm_dp_encode_sideband_req(in, txmsg);
 	ret = drm_dp_decode_sideband_req(txmsg, out);
-- 
2.25.1