linux-kernel - Re: RE: [PATCH] pinctrl:sunplus: Add check for kmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ac995ef4-b9ab-4771-a3a1-46054ba303c6@kili.mountain>
Date:   Thu, 25 May 2023 22:42:29 +0300
From:   Dan Carpenter <dan.carpenter@...aro.org>
To:     Christophe JAILLET <christophe.jaillet@...adoo.fr>
Cc:     Wells Lu 呂芳騰 <wells.lu@...plus.com>,
        "andy.shevchenko@...il.com" <andy.shevchenko@...il.com>,
        Wells Lu <wellslutw@...il.com>,
        "linus.walleij@...aro.org" <linus.walleij@...aro.org>,
        "linux-gpio@...r.kernel.org" <linux-gpio@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Kernel Janitors <kernel-janitors@...r.kernel.org>
Subject: Re: RE: [PATCH] pinctrl:sunplus: Add check for kmalloc

On Thu, May 25, 2023 at 08:37:36PM +0200, Christophe JAILLET wrote:
> 
> Hi,
> (adding Dan in copy because the initial report is related to smatch)
> 
> I don't use kmemleak, but could you share some input about its report?
> 
> 
> I've not rechecked my analysis, but it looked promising.
> Maybe Dan could also give a look at it and confirm your finding, or dig
> further with smatch to make sure that its static analysis was complete
> enough.

Smatch doesn't really complain about memory leaks.  I wrote that check
13 years ago and focused more on avoiding false positives instead of
being thorough.  It turns out that avoiding false positives is
achievable but pretty useless.

Checking for the of_get_parent() leaks is probably easier.  I could just
add it to check_unwind.c or create something custom.  The heuristic for
the custom check would be to print a warning if the success path
releases it but the others don't.

regards,
dan carpenter