From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>,
Thomas Hellstrom <thellstrom@vmware.com>
Subject: [PATCH 4.14 05/21] drm/vmwgfx: Fix double free in vmw_recv_msg()
Date: Fri, 13 Sep 2019 14:06:58 +0100 [thread overview]
Message-ID: <20190913130503.441739156@linuxfoundation.org> (raw)
In-Reply-To: <20190913130501.285837292@linuxfoundation.org>
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 08b0c891605acf727e43e3e03a25857d3e789b61 upstream.
We recently added a kfree() after the end of the loop:
if (retries == RETRIES) {
kfree(reply);
return -EINVAL;
}
There are two problems. First the test is wrong and because retries
equals RETRIES if we succeed on the last iteration through the loop.
Second if we fail on the last iteration through the loop then the kfree
is a double free.
When you're reading this code, please note the break statement at the
end of the while loop. This patch changes the loop so that if it's not
successful then "reply" is NULL and we can test for that afterward.
Cc: <stable@vger.kernel.org>
Fixes: 6b7c3b86f0b6 ("drm/vmwgfx: fix memory leak when too many retries have occurred")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -264,7 +264,7 @@ static int vmw_recv_msg(struct rpc_chann
if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) == 0) {
kfree(reply);
-
+ reply = NULL;
if ((HIGH_WORD(ebx) & MESSAGE_STATUS_CPT) != 0) {
/* A checkpoint occurred. Retry. */
continue;
@@ -288,7 +288,7 @@ static int vmw_recv_msg(struct rpc_chann
if ((HIGH_WORD(ecx) & MESSAGE_STATUS_SUCCESS) == 0) {
kfree(reply);
-
+ reply = NULL;
if ((HIGH_WORD(ecx) & MESSAGE_STATUS_CPT) != 0) {
/* A checkpoint occurred. Retry. */
continue;
@@ -300,10 +300,8 @@ static int vmw_recv_msg(struct rpc_chann
break;
}
- if (retries == RETRIES) {
- kfree(reply);
+ if (!reply)
return -EINVAL;
- }
*msg_len = reply_len;
*msg = reply;
next prev parent reply other threads:[~2019-09-13 13:10 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-13 13:06 [PATCH 4.14 00/21] 4.14.144-stable review Greg Kroah-Hartman
2019-09-13 13:06 ` [PATCH 4.14 01/21] ALSA: hda - Fix potential endless loop at applying quirks Greg Kroah-Hartman
2019-09-13 13:06 ` [PATCH 4.14 02/21] ALSA: hda/realtek - Fix overridden device-specific initialization Greg Kroah-Hartman
2019-09-13 13:06 ` [PATCH 4.14 03/21] ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre Greg Kroah-Hartman
2019-09-13 13:06 ` [PATCH 4.14 04/21] sched/fair: Dont assign runtime for throttled cfs_rq Greg Kroah-Hartman
2019-09-13 13:06 ` Greg Kroah-Hartman [this message]
2019-09-13 13:06 ` [PATCH 4.14 06/21] powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 07/21] xfrm: clean up xfrm protocol checks Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 08/21] ip6: fix skb leak in ip6frag_expire_frag_queue() Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 09/21] PCI: designware-ep: Fix find_first_zero_bit() usage Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 10/21] PCI: dra7xx: Fix legacy INTD IRQ handling Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 11/21] vhost/test: fix build for vhost test Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 12/21] batman-adv: fix uninit-value in batadv_netlink_get_ifindex() Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 13/21] batman-adv: Only read OGM tvlv_len after buffer len check Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 14/21] hv_sock: Fix hang when a connection is closed Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 15/21] powerpc/64: mark start_here_multiplatform as __ref Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 16/21] arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64 Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 17/21] scripts/decode_stacktrace: match basepath using shell prefix operator, not regex Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 18/21] clk: s2mps11: Add used attribute to s2mps11_dt_match Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 19/21] kernel/module: Fix mem leak in module_add_modinfo_attrs Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 20/21] vhost: block speculation of translated descriptors Greg Kroah-Hartman
2019-09-13 13:07 ` [PATCH 4.14 21/21] vhost: make sure log_num < in_num Greg Kroah-Hartman
2019-09-13 19:59 ` [PATCH 4.14 00/21] 4.14.144-stable review kernelci.org bot
2019-09-14 4:03 ` Naresh Kamboju
2019-09-14 14:06 ` Guenter Roeck
2019-09-15 13:35 ` Greg Kroah-Hartman
2019-09-16 10:55 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190913130503.441739156@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dan.carpenter@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=thellstrom@vmware.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).