linux-kernel - [PATCH] USB: serial: whiteheat: use stack instead of heap memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat,  4 Feb 2023 14:46:51 +0100
From:   Nam Cao <namcaov@...il.com>
To:     Johan Hovold <johan@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        Nam Cao <namcaov@...il.com>
Subject: [PATCH] USB: serial: whiteheat: use stack instead of heap memory

Some buffers in whiteheat_attach() are small and only used locally. Move
them to the stack to avoid complications with heap memory.

Compile-tested only.

Signed-off-by: Nam Cao <namcaov@...il.com>
---
 drivers/usb/serial/whiteheat.c | 25 ++++---------------------
 1 file changed, 4 insertions(+), 21 deletions(-)

diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index 7f82d40753ee..4ad8915b536b 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -220,22 +220,16 @@ static int whiteheat_attach(struct usb_serial *serial)
 	int pipe;
 	int ret;
 	int alen;
-	__u8 *command;
-	__u8 *result;
+	__u8 command[2];
+	__u8 result[sizeof(*hw_info) + 1];
 
 	command_port = serial->port[COMMAND_PORT];
 
 	pipe = usb_sndbulkpipe(serial->dev,
 			command_port->bulk_out_endpointAddress);
-	command = kmalloc(2, GFP_KERNEL);
-	if (!command)
-		goto no_command_buffer;
+
 	command[0] = WHITEHEAT_GET_HW_INFO;
 	command[1] = 0;
-
-	result = kmalloc(sizeof(*hw_info) + 1, GFP_KERNEL);
-	if (!result)
-		goto no_result_buffer;
 	/*
 	 * When the module is reloaded the firmware is still there and
 	 * the endpoints are still in the usb core unchanged. This is the
@@ -283,7 +277,7 @@ static int whiteheat_attach(struct usb_serial *serial)
 	command_info = kmalloc(sizeof(struct whiteheat_command_private),
 								GFP_KERNEL);
 	if (!command_info)
-		goto no_command_private;
+		return -ENOMEM;
 
 	mutex_init(&command_info->mutex);
 	command_info->port_running = 0;
@@ -291,8 +285,6 @@ static int whiteheat_attach(struct usb_serial *serial)
 	usb_set_serial_port_data(command_port, command_info);
 	command_port->write_urb->complete = command_port_write_callback;
 	command_port->read_urb->complete = command_port_read_callback;
-	kfree(result);
-	kfree(command);
 
 	return 0;
 
@@ -307,16 +299,7 @@ static int whiteheat_attach(struct usb_serial *serial)
 	dev_err(&serial->dev->dev,
 		"%s: please contact support@...necttech.com\n",
 		serial->type->description);
-	kfree(result);
-	kfree(command);
 	return -ENODEV;
-
-no_command_private:
-	kfree(result);
-no_result_buffer:
-	kfree(command);
-no_command_buffer:
-	return -ENOMEM;
 }
 
 static void whiteheat_release(struct usb_serial *serial)
-- 
2.34.1