DMARC-Filter: OpenDMARC Filter v1.3.2 mta-p7.oit.umn.edu 4J3Qbq1GJtz9w5Jj
From:   Zhou Qingyang <zhou1615@umn.edu>
To:     zhou1615@umn.edu
Cc:     kjlu@umn.edu, David Airlie <airlied@linux.ie>,
        Daniel Vetter <daniel@ffwll.ch>,
        Lee Jones <lee.jones@linaro.org>,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: [PATCH] drm/selftests/test-drm_dp_mst_helper: A memleak in sideband_msg_req_encode_decode()
Date:   Tue, 30 Nov 2021 23:08:56 +0800
Message-Id: <20211130150858.167686-1-zhou1615@umn.edu>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

In test-drm_dp_mst_helper.c file, if the initialization of
txmsg fails in sideband_msg_req_encode_decode(),
this function will directly return false and forget to free
the variable out, which will lead to a possible memory leak.

Although this bug is not serious as it belongs to testing code, it is
better to be fixed to avoid unexpected behavior in testing.

I fix this bug by changing 'return false' to 'goto out'.

This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.

Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.

we build kernel with CONFIG_DRM_DEBUG_SELFTEST=m and show no warnings.
Also our static analyzer no longer warns.

Fixes:  09234b88ef55 ( "drm/selftests/test-drm_dp_mst_helper: Move 'sideband_msg_req_encode_decode' onto the heap")
Signed-off-by: Zhou Qingyang <zhou1615@umn.edu>
---
 drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c b/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c
index 6b4759ed6bfd..e74cea9dafc6 100644
--- a/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c
+++ b/drivers/gpu/drm/selftests/test-drm_dp_mst_helper.c
@@ -132,7 +132,7 @@ sideband_msg_req_encode_decode(struct drm_dp_sideband_msg_req_body *in)
 
 	txmsg = kzalloc(sizeof(*txmsg), GFP_KERNEL);
 	if (!txmsg)
-		return false;
+		goto out;
 
 	drm_dp_encode_sideband_req(in, txmsg);
 	ret = drm_dp_decode_sideband_req(txmsg, out);
-- 
2.25.1