2014-04-04 19:06:07

by Christoph Jaeger

Subject: [PATCH] drivers: mcb: fix memory leak in chameleon_parse_cells() error path

chameleon_parse_cells() bails out if chameleon descriptor type is
invalid but does not free the storage 'header' points to.

Signed-off-by: Christoph Jaeger <[email protected]>
---
drivers/mcb/mcb-parse.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
index d1278b5..0049269 100644
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -141,6 +141,7 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
default:
pr_err("Invalid chameleon descriptor type 0x%x\n",
dtype);
+ kfree(header);
return -EINVAL;
}
num_cells++;
--
1.9.0

2014-04-07 14:02:19

by Johannes Thumshirn

Subject: Re: [PATCH] drivers: mcb: fix memory leak in chameleon_parse_cells() error path

On Fri, Apr 04, 2014 at 09:04:58PM +0200, Christoph Jaeger wrote:
> chameleon_parse_cells() bails out if chameleon descriptor type is
> invalid but does not free the storage 'header' points to.
>
> Signed-off-by: Christoph Jaeger <[email protected]>
> ---
> drivers/mcb/mcb-parse.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
> index d1278b5..0049269 100644
> --- a/drivers/mcb/mcb-parse.c
> +++ b/drivers/mcb/mcb-parse.c
> @@ -141,6 +141,7 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
> default:
> pr_err("Invalid chameleon descriptor type 0x%x\n",
> dtype);
> + kfree(header);
> return -EINVAL;
> }
> num_cells++;
> --
> 1.9.0
>

*Doh*

Thanks for the patch.

@Greg, how should be the process here? Should I collect MCB related patches
somewhere and forward them to you, or do you pick them up yourself?

Thanks,
Johannes

2014-04-07 16:28:53

by Greg Kroah-Hartman

Subject: Re: [PATCH] drivers: mcb: fix memory leak in chameleon_parse_cells() error path

On Mon, Apr 07, 2014 at 04:02:06PM +0200, Johannes Thumshirn wrote:
> On Fri, Apr 04, 2014 at 09:04:58PM +0200, Christoph Jaeger wrote:
> > chameleon_parse_cells() bails out if chameleon descriptor type is
> > invalid but does not free the storage 'header' points to.
> >
> > Signed-off-by: Christoph Jaeger <[email protected]>
> > ---
> > drivers/mcb/mcb-parse.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
> > index d1278b5..0049269 100644
> > --- a/drivers/mcb/mcb-parse.c
> > +++ b/drivers/mcb/mcb-parse.c
> > @@ -141,6 +141,7 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
> > default:
> > pr_err("Invalid chameleon descriptor type 0x%x\n",
> > dtype);
> > + kfree(header);
> > return -EINVAL;
> > }
> > num_cells++;
> > --
> > 1.9.0
> >
>
> *Doh*
>
> Thanks for the patch.
>
> @Greg, how should be the process here? Should I collect MCB related patches
> somewhere and forward them to you, or do you pick them up yourself?

Please collect them up and forward them on to me, that's what a
maintainer's job is :)

thanks,

greg k-h

2014-04-10 06:16:31

by Johannes Thumshirn

Subject: Re: [PATCH] drivers: mcb: fix memory leak in chameleon_parse_cells() error path

On Fri, Apr 04, 2014 at 09:04:58PM +0200, Christoph Jaeger wrote:
> chameleon_parse_cells() bails out if chameleon descriptor type is
> invalid but does not free the storage 'header' points to.
>
> Signed-off-by: Christoph Jaeger <[email protected]>
> ---
> drivers/mcb/mcb-parse.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
> index d1278b5..0049269 100644
> --- a/drivers/mcb/mcb-parse.c
> +++ b/drivers/mcb/mcb-parse.c
> @@ -141,6 +141,7 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
> default:
> pr_err("Invalid chameleon descriptor type 0x%x\n",
> dtype);
> + kfree(header);
> return -EINVAL;
> }
> num_cells++;
> --
> 1.9.0
>

Hi,

Your patch has been applied to my repo located at:

https://github.com/morbidrsa/linux/tree/mcb

or

git://github.com/morbidrsa/linux.git

Thanks,
Johannes