linux-kernel - Re: [PATCH v2] of: overlay: fix memory leak in add_changeset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <9ec55a8e-5ce4-6846-f88d-2d9b33a34bc9@huawei.com>
Date:   Mon, 21 Nov 2022 14:07:08 +0800
From:   Zeng Heng <zengheng4@...wei.com>
To:     <robh+dt@...nel.org>, <frowand.list@...il.com>,
        Frank Rowand <frowand.list@...il.com>,
        <pantelis.antoniou@...sulko.com>, <grant.likely@...aro.org>,
        <robh+dt@...nel.org>
CC:     <devicetree@...r.kernel.org>, <liwei391@...wei.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] of: overlay: fix memory leak in add_changeset_node()

+cc linux-kernel-mail-list


On 2022/11/21 11:53, Zeng Heng wrote:
> When of_changeset_attach_node() returns fail and tchild is
> over of life cycle which is duplicated by __of_node_dup(),
> it needs to call of_node_put() to release tchild in
> error handle route.
>
> Otherwise, there are some memory leak reported about the node:
>
> unreferenced object 0xffff88810cd1e800 (size 256):
>    backtrace:
>      kmalloc_trace
>      __of_node_dup
>      add_changeset_node (inlined)
>      build_changeset_next_level
>
> unreferenced object 0xffff888113721240 (size 16):
>    backtrace:
>      __kmalloc_node_track_caller
>      kstrdup
>      __of_node_dup
>      add_changeset_node (inlined)
>      build_changeset_next_level
>
> unreferenced object 0xffff88810a38d400 (size 128):
>    backtrace:
>      kmalloc_trace
>      __of_prop_dup
>      add_changeset_property
>      build_changeset_next_level
>
> Fixes: 0290c4ca2536 ("of: overlay: rename identifiers to more reflect what they do")
> Signed-off-by: Zeng Heng <zengheng4@...wei.com>
> ---
>   drivers/of/overlay.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
> index bd8ff4df723d..a5189a0ec0a3 100644
> --- a/drivers/of/overlay.c
> +++ b/drivers/of/overlay.c
> @@ -436,8 +436,10 @@ static int add_changeset_node(struct overlay_changeset *ovcs,
>   		of_node_set_flag(tchild, OF_OVERLAY);
>   
>   		ret = of_changeset_attach_node(&ovcs->cset, tchild);
> -		if (ret)
> +		if (ret) {
> +			of_node_put(tchild);
>   			return ret;
> +		}
>   
>   		target_child.np = tchild;
>   		target_child.in_livetree = false;