lkml.org 
[lkml]   [2020]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 532/639] staging: greybus: light: fix a couple double frees
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ]

    The problem is in gb_lights_request_handler(). If we get a request to
    change the config then we release the light with gb_lights_light_release()
    and re-allocated it. However, if the allocation fails part way through
    then we call gb_lights_light_release() again. This can lead to a couple
    different double frees where we haven't cleared out the original values:

    gb_lights_light_v4l2_unregister(light);
    ...
    kfree(light->channels);
    kfree(light->name);

    I also made a small change to how we set "light->channels_count = 0;".
    The original code handled this part fine and did not cause a use after
    free but it was sort of complicated to read.

    Fixes: 2870b52bae4c ("greybus: lights: add lights implementation")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
    Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/staging/greybus/light.c | 12 ++++++------
    1 file changed, 6 insertions(+), 6 deletions(-)

    diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
    index 010ae1e9c7fbf..40680eaf3974f 100644
    --- a/drivers/staging/greybus/light.c
    +++ b/drivers/staging/greybus/light.c
    @@ -1098,21 +1098,21 @@ static void gb_lights_channel_release(struct gb_channel *channel)
    static void gb_lights_light_release(struct gb_light *light)
    {
    int i;
    - int count;

    light->ready = false;

    - count = light->channels_count;
    -
    if (light->has_flash)
    gb_lights_light_v4l2_unregister(light);
    + light->has_flash = false;

    - for (i = 0; i < count; i++) {
    + for (i = 0; i < light->channels_count; i++)
    gb_lights_channel_release(&light->channels[i]);
    - light->channels_count--;
    - }
    + light->channels_count = 0;
    +
    kfree(light->channels);
    + light->channels = NULL;
    kfree(light->name);
    + light->name = NULL;
    }

    static void gb_lights_release(struct gb_lights *glights)
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-24 12:30    [W:4.840 / U:0.788 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site