* [PATCH AUTOSEL 4.9 056/251] staging: most: cdev: add missing check for cdev_add failure
[not found] <20200116173641.22137-1-sashal@kernel.org>
@ 2020-01-16 17:33 ` Sasha Levin
2020-01-16 17:35 ` [PATCH AUTOSEL 4.9 193/251] staging: greybus: light: fix a couple double frees Sasha Levin
1 sibling, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2020-01-16 17:33 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sasha Levin, Colin Ian King, devel, Greg Kroah-Hartman
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 5ae890780e1b4d08f2c0c5d4ea96fc3928fc0ee9 ]
Currently the call to cdev_add is missing a check for failure. Fix this by
checking for failure and exiting via a new error path that ensures the
allocated comp_channel struct is kfree'd.
Detected by CoverityScan, CID#1462359 ("Unchecked return value")
Fixes: 9bc79bbcd0c5 ("Staging: most: add MOST driver's aim-cdev module")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/most/aim-cdev/cdev.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/most/aim-cdev/cdev.c b/drivers/staging/most/aim-cdev/cdev.c
index 7f51024dc5eb..e87b9ed4f37d 100644
--- a/drivers/staging/most/aim-cdev/cdev.c
+++ b/drivers/staging/most/aim-cdev/cdev.c
@@ -451,7 +451,9 @@ static int aim_probe(struct most_interface *iface, int channel_id,
c->devno = MKDEV(major, current_minor);
cdev_init(&c->cdev, &channel_fops);
c->cdev.owner = THIS_MODULE;
- cdev_add(&c->cdev, c->devno, 1);
+ retval = cdev_add(&c->cdev, c->devno, 1);
+ if (retval < 0)
+ goto err_free_c;
c->iface = iface;
c->cfg = cfg;
c->channel_id = channel_id;
@@ -487,6 +489,7 @@ static int aim_probe(struct most_interface *iface, int channel_id,
list_del(&c->list);
error_alloc_kfifo:
cdev_del(&c->cdev);
+err_free_c:
kfree(c);
error_alloc_channel:
ida_simple_remove(&minor_id, current_minor);
--
2.20.1
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [PATCH AUTOSEL 4.9 193/251] staging: greybus: light: fix a couple double frees
[not found] <20200116173641.22137-1-sashal@kernel.org>
2020-01-16 17:33 ` [PATCH AUTOSEL 4.9 056/251] staging: most: cdev: add missing check for cdev_add failure Sasha Levin
@ 2020-01-16 17:35 ` Sasha Levin
1 sibling, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2020-01-16 17:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sasha Levin, devel, greybus-dev, Greg Kroah-Hartman, Dan Carpenter
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ]
The problem is in gb_lights_request_handler(). If we get a request to
change the config then we release the light with gb_lights_light_release()
and re-allocated it. However, if the allocation fails part way through
then we call gb_lights_light_release() again. This can lead to a couple
different double frees where we haven't cleared out the original values:
gb_lights_light_v4l2_unregister(light);
...
kfree(light->channels);
kfree(light->name);
I also made a small change to how we set "light->channels_count = 0;".
The original code handled this part fine and did not cause a use after
free but it was sort of complicated to read.
Fixes: 2870b52bae4c ("greybus: lights: add lights implementation")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/greybus/light.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
index 9f01427f35f9..1cb82cc28aa7 100644
--- a/drivers/staging/greybus/light.c
+++ b/drivers/staging/greybus/light.c
@@ -1102,21 +1102,21 @@ static void gb_lights_channel_release(struct gb_channel *channel)
static void gb_lights_light_release(struct gb_light *light)
{
int i;
- int count;
light->ready = false;
- count = light->channels_count;
-
if (light->has_flash)
gb_lights_light_v4l2_unregister(light);
+ light->has_flash = false;
- for (i = 0; i < count; i++) {
+ for (i = 0; i < light->channels_count; i++)
gb_lights_channel_release(&light->channels[i]);
- light->channels_count--;
- }
+ light->channels_count = 0;
+
kfree(light->channels);
+ light->channels = NULL;
kfree(light->name);
+ light->name = NULL;
}
static void gb_lights_release(struct gb_lights *glights)
--
2.20.1
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
^ permalink raw reply related [flat|nested] 2+ messages in thread