Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1946284AbbEVJRU (ORCPT ); Fri, 22 May 2015 05:17:20 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:35247 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757224AbbEVJAF (ORCPT ); Fri, 22 May 2015 05:00:05 -0400 From: Luis Henriques To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Dan Carpenter , Dave Young , Guangyu Sun , Matt Fleming , Luis Henriques Subject: [PATCH 3.16.y-ckt 091/129] efi: Fix error handling in add_sysfs_runtime_map_entry() Date: Fri, 22 May 2015 09:57:56 +0100 Message-Id: <1432285114-9254-92-git-send-email-luis.henriques@canonical.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1432285114-9254-1-git-send-email-luis.henriques@canonical.com> References: <1432285114-9254-1-git-send-email-luis.henriques@canonical.com> X-Extended-Stable: 3.16 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1978 Lines: 60 3.16.7-ckt12 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Carpenter commit d67e199611b986b345ea3087ee2e4a15da1c98b3 upstream. I spotted two (difficult to hit) bugs while reviewing this. 1) There is a double free bug because we unregister "map_kset" in add_sysfs_runtime_map_entry() and also efi_runtime_map_init(). 2) If we fail to allocate "entry" then we should return ERR_PTR(-ENOMEM) instead of NULL. Signed-off-by: Dan Carpenter Cc: Dave Young Cc: Guangyu Sun Signed-off-by: Matt Fleming Signed-off-by: Luis Henriques --- drivers/firmware/efi/runtime-map.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c index c98b101a73ae..019a7e32de4c 100644 --- a/drivers/firmware/efi/runtime-map.c +++ b/drivers/firmware/efi/runtime-map.c @@ -120,7 +120,8 @@ add_sysfs_runtime_map_entry(struct kobject *kobj, int nr) entry = kzalloc(sizeof(*entry), GFP_KERNEL); if (!entry) { kset_unregister(map_kset); - return entry; + map_kset = NULL; + return ERR_PTR(-ENOMEM); } memcpy(&entry->md, efi_runtime_map + nr * efi_memdesc_size, @@ -132,6 +133,7 @@ add_sysfs_runtime_map_entry(struct kobject *kobj, int nr) if (ret) { kobject_put(&entry->kobj); kset_unregister(map_kset); + map_kset = NULL; return ERR_PTR(ret); } @@ -174,8 +176,6 @@ out_add_entry: entry = *(map_entries + j); kobject_put(&entry->kobj); } - if (map_kset) - kset_unregister(map_kset); out: return ret; } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/