linux-kernel - drivers/fpga/intel-m10-bmc-sec-update.c:103 flash_count_show() warn: possible memory leak of 'flash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <202209160713.HoIRfGTB-lkp@intel.com>
Date:   Fri, 16 Sep 2022 09:56:47 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Russ Weight <russell.h.weight@...el.com>
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        linux-kernel@...r.kernel.org, Xu Yilun <yilun.xu@...el.com>,
        Tom Rix <trix@...hat.com>
Subject: drivers/fpga/intel-m10-bmc-sec-update.c:103 flash_count_show() warn:
 possible memory leak of 'flash_buf'

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   3245cb65fd91cd514801bf91f5a3066d562f0ac4
commit: 154afa5c31cd2de5e6c2c4f35eee390993ee345a fpga: m10bmc-sec: expose max10 flash update count
config: m68k-randconfig-m031-20220914 (https://download.01.org/0day-ci/archive/20220916/202209160713.HoIRfGTB-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 12.1.0

If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

smatch warnings:
drivers/fpga/intel-m10-bmc-sec-update.c:103 flash_count_show() warn: possible memory leak of 'flash_buf'

vim +/flash_buf +103 drivers/fpga/intel-m10-bmc-sec-update.c

154afa5c31cd2d Russ Weight 2022-06-06   83  static ssize_t flash_count_show(struct device *dev,
154afa5c31cd2d Russ Weight 2022-06-06   84  				struct device_attribute *attr, char *buf)
154afa5c31cd2d Russ Weight 2022-06-06   85  {
154afa5c31cd2d Russ Weight 2022-06-06   86  	struct m10bmc_sec *sec = dev_get_drvdata(dev);
154afa5c31cd2d Russ Weight 2022-06-06   87  	unsigned int stride, num_bits;
154afa5c31cd2d Russ Weight 2022-06-06   88  	u8 *flash_buf;
154afa5c31cd2d Russ Weight 2022-06-06   89  	int cnt, ret;
154afa5c31cd2d Russ Weight 2022-06-06   90  
154afa5c31cd2d Russ Weight 2022-06-06   91  	stride = regmap_get_reg_stride(sec->m10bmc->regmap);
154afa5c31cd2d Russ Weight 2022-06-06   92  	num_bits = FLASH_COUNT_SIZE * 8;
154afa5c31cd2d Russ Weight 2022-06-06   93  
154afa5c31cd2d Russ Weight 2022-06-06   94  	flash_buf = kmalloc(FLASH_COUNT_SIZE, GFP_KERNEL);
154afa5c31cd2d Russ Weight 2022-06-06   95  	if (!flash_buf)
154afa5c31cd2d Russ Weight 2022-06-06   96  		return -ENOMEM;
154afa5c31cd2d Russ Weight 2022-06-06   97  
154afa5c31cd2d Russ Weight 2022-06-06   98  	if (FLASH_COUNT_SIZE % stride) {
154afa5c31cd2d Russ Weight 2022-06-06   99  		dev_err(sec->dev,
154afa5c31cd2d Russ Weight 2022-06-06  100  			"FLASH_COUNT_SIZE (0x%x) not aligned to stride (0x%x)\n",
154afa5c31cd2d Russ Weight 2022-06-06  101  			FLASH_COUNT_SIZE, stride);
154afa5c31cd2d Russ Weight 2022-06-06  102  		WARN_ON_ONCE(1);

do this check before the kmalloc()?

154afa5c31cd2d Russ Weight 2022-06-06 @103  		return -EINVAL;
154afa5c31cd2d Russ Weight 2022-06-06  104  	}
154afa5c31cd2d Russ Weight 2022-06-06  105  
154afa5c31cd2d Russ Weight 2022-06-06  106  	ret = regmap_bulk_read(sec->m10bmc->regmap, STAGING_FLASH_COUNT,
154afa5c31cd2d Russ Weight 2022-06-06  107  			       flash_buf, FLASH_COUNT_SIZE / stride);
154afa5c31cd2d Russ Weight 2022-06-06  108  	if (ret) {
154afa5c31cd2d Russ Weight 2022-06-06  109  		dev_err(sec->dev,
154afa5c31cd2d Russ Weight 2022-06-06  110  			"failed to read flash count: %x cnt %x: %d\n",
154afa5c31cd2d Russ Weight 2022-06-06  111  			STAGING_FLASH_COUNT, FLASH_COUNT_SIZE / stride, ret);
154afa5c31cd2d Russ Weight 2022-06-06  112  		goto exit_free;
154afa5c31cd2d Russ Weight 2022-06-06  113  	}
154afa5c31cd2d Russ Weight 2022-06-06  114  	cnt = num_bits - bitmap_weight((unsigned long *)flash_buf, num_bits);
154afa5c31cd2d Russ Weight 2022-06-06  115  
154afa5c31cd2d Russ Weight 2022-06-06  116  exit_free:
154afa5c31cd2d Russ Weight 2022-06-06  117  	kfree(flash_buf);
154afa5c31cd2d Russ Weight 2022-06-06  118  
154afa5c31cd2d Russ Weight 2022-06-06  119  	return ret ? : sysfs_emit(buf, "%u\n", cnt);
154afa5c31cd2d Russ Weight 2022-06-06  120  }

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp