Received-SPF: pass (google.com: domain of linux-kernel+bounces-38059-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Thu, 25 Jan 2024 10:11:15 +0300
From: Dan Carpenter <dan.carpenter@linaro.org>
To: Su Hui <suhui@nfschina.com>
Cc: jikos@kernel.org, benjamin.tissoires@redhat.com, mail@karthek.com,
	linux-input@vger.kernel.org, linux-kernel@vger.kernel.org,
	kernel-janitors@vger.kernel.org
Subject: Re: [PATCH] HID: hidraw: fix a problem of memory leak in
 hidraw_release()
Message-ID: <76300deb-f532-4d74-a97a-4cd321ae8f41@moroto.mountain>
References: <20240125063225.2796234-1-suhui@nfschina.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240125063225.2796234-1-suhui@nfschina.com>

On Thu, Jan 25, 2024 at 02:32:26PM +0800, Su Hui wrote:
> 'struct hidraw_list' is a circular queue whose head can be smaller than
> tail. Using 'list->tail != list->head' to release all memory that should
> be released.
> 
> Fixes: a5623a203cff ("HID: hidraw: fix memory leak in hidraw_release()")
> Signed-off-by: Su Hui <suhui@nfschina.com>

This is very clever.  How did you find that?  Was it through static
analysis or just review?  Perhaps using syzkaller?

Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>

I imagine we could write a checker heuristic to identify ->tail and
->head struct members and then complain if they were ever used in a <
or > comparison.

regards,
dan carpenter