lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250704024010.2353841-1-jiangyunshui@kylinos.cn>
Date: Fri,  4 Jul 2025 10:40:10 +0800
From: Yunshui Jiang <jiangyunshui@...inos.cn>
To: linux-kernel@...r.kernel.org
Cc: linux-input@...r.kernel.org,
	dmitry.torokhov@...il.com,
	Yunshui Jiang <jiangyunshui@...inos.cn>
Subject: [PATCH] Input: cs40l50: Fix potential NULL dereference and memory leak

The cs40l50_upload_owt() function allocates memory via kmalloc()
without checking for allocation failure, which could lead to a
NULL pointer dereference when GFP_KERNEL allocation fails under
memory pressure.

Additionally, if any subsequent operation fails after successful
allocation, the allocated memory is not freed, causing a memory
leak.

Therefore, add a NULL check for kmalloc() and returns -ENOMEM on
failure. And use a goto cleanup pattern to ensure the allocated
memory is freed on any error path.

Signed-off-by: Yunshui Jiang <jiangyunshui@...inos.cn>
---
 drivers/input/misc/cs40l50-vibra.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/input/misc/cs40l50-vibra.c b/drivers/input/misc/cs40l50-vibra.c
index dce3b0ec8cf3..c48b6c905112 100644
--- a/drivers/input/misc/cs40l50-vibra.c
+++ b/drivers/input/misc/cs40l50-vibra.c
@@ -238,25 +238,31 @@ static int cs40l50_upload_owt(struct cs40l50_work *work_data)
 	header.data_words = len / sizeof(u32);
 
 	new_owt_effect_data = kmalloc(sizeof(header) + len, GFP_KERNEL);
+	if (!new_owt_effect_data)
+		return -ENOMEM;
 
 	memcpy(new_owt_effect_data, &header, sizeof(header));
 	memcpy(new_owt_effect_data + sizeof(header), work_data->custom_data, len);
 
 	error = regmap_read(vib->regmap, vib->dsp.owt_offset_reg, &offset);
 	if (error)
-		return error;
+		goto free_owt_data;
 
 	error = regmap_bulk_write(vib->regmap, vib->dsp.owt_base_reg +
 				  (offset * sizeof(u32)), new_owt_effect_data,
 				  sizeof(header) + len);
 	if (error)
-		return error;
+		goto free_owt_data;
 
 	error = vib->dsp.write(vib->dev, vib->regmap, vib->dsp.push_owt_cmd);
 	if (error)
-		return error;
+		goto free_owt_data;
 
 	return 0;
+
+free_owt_data:
+	kfree(new_owt_effect_data);
+	return error;
 }
 
 static void cs40l50_add_worker(struct work_struct *work)
-- 
2.47.1


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ