2023-10-08 03:29:56

by Hao Ge

Subject: [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()

dsp_chan->name and chan_name points to same block of memory,
because dev_err still needs to be used it,so we need free
it's memory after use to avoid use_after_free.

Fixes: e527adfb9b7d ("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()")
Signed-off-by: Hao Ge <[email protected]>
---
drivers/firmware/imx/imx-dsp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/imx/imx-dsp.c b/drivers/firmware/imx/imx-dsp.c
index 508eab346fc6..a48a58e0c61f 100644
--- a/drivers/firmware/imx/imx-dsp.c
+++ b/drivers/firmware/imx/imx-dsp.c
@@ -114,11 +114,11 @@ static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc)
dsp_chan->idx = i % 2;
dsp_chan->ch = mbox_request_channel_byname(cl, chan_name);
if (IS_ERR(dsp_chan->ch)) {
- kfree(dsp_chan->name);
ret = PTR_ERR(dsp_chan->ch);
if (ret != -EPROBE_DEFER)
dev_err(dev, "Failed to request mbox chan %s ret %d\n",
chan_name, ret);
+ kfree(dsp_chan->name);
goto out;
}

--
2.25.1

2023-10-09 11:07:52

by Daniel Baluta

Subject: Re: [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()

On Sun, Oct 8, 2023 at 6:30 AM Hao Ge <[email protected]> wrote:
>
> dsp_chan->name and chan_name points to same block of memory,
> because dev_err still needs to be used it,so we need free
> it's memory after use to avoid use_after_free.
>
> Fixes: e527adfb9b7d ("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()")
> Signed-off-by: Hao Ge <[email protected]>

Reviewed-by: Daniel Baluta <[email protected]>

> ---
> drivers/firmware/imx/imx-dsp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/firmware/imx/imx-dsp.c b/drivers/firmware/imx/imx-dsp.c
> index 508eab346fc6..a48a58e0c61f 100644
> --- a/drivers/firmware/imx/imx-dsp.c
> +++ b/drivers/firmware/imx/imx-dsp.c
> @@ -114,11 +114,11 @@ static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc)
> dsp_chan->idx = i % 2;
> dsp_chan->ch = mbox_request_channel_byname(cl, chan_name);
> if (IS_ERR(dsp_chan->ch)) {
> - kfree(dsp_chan->name);
> ret = PTR_ERR(dsp_chan->ch);
> if (ret != -EPROBE_DEFER)
> dev_err(dev, "Failed to request mbox chan %s ret %d\n",
> chan_name, ret);
> + kfree(dsp_chan->name);
> goto out;
> }
>
> --
> 2.25.1
>

2023-10-10 02:33:33

by Shawn Guo

Subject: Re: [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()

On Sun, Oct 08, 2023 at 11:29:08AM +0800, Hao Ge wrote:
> dsp_chan->name and chan_name points to same block of memory,
> because dev_err still needs to be used it,so we need free
> it's memory after use to avoid use_after_free.
>
> Fixes: e527adfb9b7d ("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()")
> Signed-off-by: Hao Ge <[email protected]>

Applied, thanks!