linux-kernel - Re: [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEnQRZBKkFxgpxJVcnmFQe33abQ-36ZXL_GgNgE3jVwH5+dEJQ@mail.gmail.com>
Date:   Mon, 9 Oct 2023 14:07:33 +0300
From:   Daniel Baluta <daniel.baluta@...il.com>
To:     Hao Ge <gehao@...inos.cn>
Cc:     shawnguo@...nel.org, s.hauer@...gutronix.de, kernel@...gutronix.de,
        festevam@...il.com, linux-imx@....com,
        christophe.jaillet@...adoo.fr, robh@...nel.org, treding@...dia.com,
        daniel.baluta@....com, linux-arm-kernel@...ts.infradead.org,
        linux-kernel@...r.kernel.org, gehao618@....com
Subject: Re: [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()

On Sun, Oct 8, 2023 at 6:30 AM Hao Ge <gehao@...inos.cn> wrote:
>
> dsp_chan->name and chan_name points to same block of memory,
> because dev_err still needs to be used it,so we need free
> it's memory after use to avoid use_after_free.
>
> Fixes: e527adfb9b7d ("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()")
> Signed-off-by: Hao Ge <gehao@...inos.cn>

Reviewed-by: Daniel Baluta <daniel.baluta@....com>

> ---
>  drivers/firmware/imx/imx-dsp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/firmware/imx/imx-dsp.c b/drivers/firmware/imx/imx-dsp.c
> index 508eab346fc6..a48a58e0c61f 100644
> --- a/drivers/firmware/imx/imx-dsp.c
> +++ b/drivers/firmware/imx/imx-dsp.c
> @@ -114,11 +114,11 @@ static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc)
>                 dsp_chan->idx = i % 2;
>                 dsp_chan->ch = mbox_request_channel_byname(cl, chan_name);
>                 if (IS_ERR(dsp_chan->ch)) {
> -                       kfree(dsp_chan->name);
>                         ret = PTR_ERR(dsp_chan->ch);
>                         if (ret != -EPROBE_DEFER)
>                                 dev_err(dev, "Failed to request mbox chan %s ret %d\n",
>                                         chan_name, ret);
> +                       kfree(dsp_chan->name);
>                         goto out;
>                 }
>
> --
> 2.25.1
>