linux-kernel - [PATCH] scsi: ufs: core: Fix an error handling path in ufshcd_read_desc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <2c6e42205e5ec22e5e8c7c85c6deb8fde31c74da.1673781835.git.christophe.jaillet@wanadoo.fr>
Date:   Sun, 15 Jan 2023 12:24:17 +0100
From:   Christophe JAILLET <christophe.jaillet@...adoo.fr>
To:     Alim Akhtar <alim.akhtar@...sung.com>,
        Avri Altman <avri.altman@....com>,
        Bart Van Assche <bvanassche@....org>,
        "James E.J. Bottomley" <jejb@...ux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        Arthur Simchaev <Arthur.Simchaev@....com>,
        Bean Huo <beanhuo@...ron.com>
Cc:     linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org,
        Christophe JAILLET <christophe.jaillet@...adoo.fr>,
        linux-scsi@...r.kernel.org
Subject: [PATCH] scsi: ufs: core: Fix an error handling path in ufshcd_read_desc_param()

If an error occurs, some memory may need to be freed, as in the other
error handling paths.

Before the commit in the Fixes tag, this test was done before the memory
allocation, so there was no issue.

Fixes: 16ed9d312b42 ("scsi: ufs: core: Remove ufshcd_map_desc_id_to_length()")
Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
---
 drivers/ufs/core/ufshcd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 6ec65dcdd689..097f2489bc91 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -3452,7 +3452,8 @@ int ufshcd_read_desc_param(struct ufs_hba *hba,
 	if (param_offset >= buff_len) {
 		dev_err(hba->dev, "%s: Invalid offset 0x%x in descriptor IDN 0x%x, length 0x%x\n",
 			__func__, param_offset, desc_id, buff_len);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out;
 	}
 
 	/* Sanity check */
-- 
2.34.1