linux-kernel - Re: [PATCH v2] thermal/lib: Fix memory leak on error in thermal_genl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJZ5v0iFxkOVg6FZa4Ut5FRaa0uC0ngSuOuacVn6yc3JFiw-Bw@mail.gmail.com>
Date: Thu, 24 Oct 2024 16:58:06 +0200
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Daniel Lezcano <daniel.lezcano@...aro.org>
Cc: rafael@...nel.org, Lukasz Luba <lukasz.luba@....com>, Zhang Rui <rui.zhang@...el.com>, 
	"open list:THERMAL" <linux-pm@...r.kernel.org>, open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] thermal/lib: Fix memory leak on error in thermal_genl_auto()

On Thu, Oct 24, 2024 at 4:26 PM Daniel Lezcano
<daniel.lezcano@...aro.org> wrote:
>
> The function thermal_genl_auto() does not free the allocated message
> in the error path. Fix that by putting a out label and jump to it
> which will free the message instead of directly returning an error.
>
> Reported-by: Lukasz Luba <lukasz.luba@....com>
> Signed-off-by: Daniel Lezcano <daniel.lezcano@...aro.org>
> ---
>   Changelog:
>     - V2:
>       - Return when the allocation fails instead of going to the out
>         label resulting in a NULL pointer passed to nlmsg_free()
> ---
>  tools/lib/thermal/commands.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/tools/lib/thermal/commands.c b/tools/lib/thermal/commands.c
> index bcf0f14d035a..4998cec793ed 100644
> --- a/tools/lib/thermal/commands.c
> +++ b/tools/lib/thermal/commands.c
> @@ -375,6 +375,7 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm
>                                          struct cmd_param *param,
>                                          int cmd, int flags, void *arg)
>  {
> +       thermal_error_t ret = THERMAL_ERROR;
>         struct nl_msg *msg;
>         void *hdr;
>
> @@ -385,17 +386,19 @@ static thermal_error_t thermal_genl_auto(struct thermal_handler *th, cmd_cb_t cm
>         hdr = genlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, thermal_cmd_ops.o_id,
>                           0, flags, cmd, THERMAL_GENL_VERSION);
>         if (!hdr)
> -               return THERMAL_ERROR;
> +               goto out;
>
>         if (cmd_cb && cmd_cb(msg, param))
> -               return THERMAL_ERROR;
> +               goto out;
>
>         if (nl_send_msg(th->sk_cmd, th->cb_cmd, msg, genl_handle_msg, arg))
> -               return THERMAL_ERROR;
> +               goto out;
>
> +       ret = THERMAL_SUCCESS;
> +out:
>         nlmsg_free(msg);
>
> -       return THERMAL_SUCCESS;
> +       return ret;
>  }
>
>  thermal_error_t thermal_cmd_get_tz(struct thermal_handler *th, struct thermal_zone **tz)
> --

Applied, thanks!