From: Thomas Hellstrom <thellstrom@vmware.com>
To: "colin.king@canonical.com" <colin.king@canonical.com>,
"dan.carpenter@oracle.com" <dan.carpenter@oracle.com>,
Linux-graphics-maintainer <Linux-graphics-maintainer@vmware.com>
Cc: "daniel@ffwll.ch" <daniel@ffwll.ch>,
"dri-devel@lists.freedesktop.org"
<dri-devel@lists.freedesktop.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"airlied@linux.ie" <airlied@linux.ie>,
"kernel-janitors@vger.kernel.org"
<kernel-janitors@vger.kernel.org>
Subject: Re: [PATCH] drm/vmwgfx: Fix double free in vmw_recv_msg()
Date: Thu, 5 Sep 2019 11:54:46 +0000 [thread overview]
Message-ID: <830c68e5591dd197e098028227148106739e5591.camel@vmware.com> (raw)
In-Reply-To: <08f19935-97fe-4c8b-ca7b-707586ed89a1@canonical.com>
On Thu, 2019-08-15 at 09:38 +0100, Colin Ian King wrote:
> On 15/08/2019 09:30, Dan Carpenter wrote:
> > We recently added a kfree() after the end of the loop:
> >
> > if (retries == RETRIES) {
> > kfree(reply);
> > return -EINVAL;
> > }
> >
> > There are two problems. First the test is wrong and because
> > retries
> > equals RETRIES if we succeed on the last iteration through the
> > loop.
> > Second if we fail on the last iteration through the loop then the
> > kfree
> > is a double free.
> >
> > When you're reading this code, please note the break statement at
> > the
> > end of the while loop. This patch changes the loop so that if it's
> > not
> > successful then "reply" is NULL and we can test for that afterward.
> >
> > Fixes: 6b7c3b86f0b6 ("drm/vmwgfx: fix memory leak when too many
> > retries have occurred")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> > drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 8 +++-----
> > 1 file changed, 3 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> > b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> > index 59e9d05ab928..0af048d1a815 100644
> > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> > @@ -353,7 +353,7 @@ static int vmw_recv_msg(struct rpc_channel
> > *channel, void **msg,
> > !!(HIGH_WORD(ecx) &
> > MESSAGE_STATUS_HB));
> > if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) == 0) {
> > kfree(reply);
> > -
> > + reply = NULL;
> > if ((HIGH_WORD(ebx) & MESSAGE_STATUS_CPT) != 0)
> > {
> > /* A checkpoint occurred. Retry. */
> > continue;
> > @@ -377,7 +377,7 @@ static int vmw_recv_msg(struct rpc_channel
> > *channel, void **msg,
> >
> > if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
> > kfree(reply);
> > -
> > + reply = NULL;
> > if ((HIGH_WORD(ecx) & MESSAGE_STATUS_CPT) != 0)
> > {
> > /* A checkpoint occurred. Retry. */
> > continue;
> > @@ -389,10 +389,8 @@ static int vmw_recv_msg(struct rpc_channel
> > *channel, void **msg,
> > break;
> > }
> >
> > - if (retries == RETRIES) {
> > - kfree(reply);
> > + if (!reply)
> > return -EINVAL;
> > - }
> >
> > *msg_len = reply_len;
> > *msg = reply;
> >
>
> Dan, Thanks for fixing up my mistake.
Thanks, Dan. Sorry for the late reply.
Reviewed-by: Thomas Hellström <thellstrom@vmware.com>
Will push this to fixes.
/Thomas
prev parent reply other threads:[~2019-09-05 11:55 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-15 8:30 [PATCH] drm/vmwgfx: Fix double free in vmw_recv_msg() Dan Carpenter
2019-08-15 8:38 ` Colin Ian King
2019-09-05 11:54 ` Thomas Hellstrom [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=830c68e5591dd197e098028227148106739e5591.camel@vmware.com \
--to=thellstrom@vmware.com \
--cc=Linux-graphics-maintainer@vmware.com \
--cc=airlied@linux.ie \
--cc=colin.king@canonical.com \
--cc=dan.carpenter@oracle.com \
--cc=daniel@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).