From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DF2DBE95A8F for ; Sun, 8 Oct 2023 03:31:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=6S2WuTI3b+2SbO8G0QD/xmpeKHg7tWCInytldI4OfNs=; b=K63+fpSxcoAGte ImA4zA+tC4Gd2QoEoVPHBpQBDHpVzAipVKxjeI1P4ZhaCAL7/NKLvkmXThNY2i2q9m5Qnpzw/Pu32 z3jElnHw7BanUKSxRabYcWZB8HOEZKVyzj+IsQo9JtfO0dBIVJ+zzylRBdzDFzZi63GzsxPgkIsPT tCER47H4gornDWza8X0BBvncWt8P8Zj7ZstXYKdq+k1g4u62HF10yiEz9sp4s9O3SWZzmwVoq5/+2 t+zS6+tvkEnoe6lRHsDue/o1LSdZ8fCPOAb8QnUDydEv7N14ADA4aQPieHrxTZml5WXwpVrdQVE8D ZHfiGLBliAyPr3KGtmrw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qpKVE-008EVF-1C; Sun, 08 Oct 2023 03:30:48 +0000 Received: from desiato.infradead.org ([2001:8b0:10b:1:d65d:64ff:fe57:4e05]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qpKVC-008EUo-0t for linux-arm-kernel@bombadil.infradead.org; Sun, 08 Oct 2023 03:30:46 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=Content-Transfer-Encoding:MIME-Version :Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:In-Reply-To:References; bh=e7cCmGLCM37ZwU74EhkE1WKsG60at6W6swzFi54iSBk=; b=raWWuuPZhLjGXHqQvFsJbm4eB1 Y0HzHK+bKgnwWlejJGfZbDnMYiYcbZMS6VRKo2WT0rR7BYNAdNT59O7y3MX9RZWWbxhE4LGNavISf Lw8Vr4iPBy7IlyDWkdZBtyYePUh+1+1eRgcjno0DqHk5oVz95xK3AxibpLInQL2CiC1NwJc/b/xAc Td6/80gIy+HSs6rNHb8FUHtgtDT2dxUzXlw2CxLQzNMDMTrqjmldkQQC2hc6TmmD+m6eII665R/Jf crHhK+A+x7Nyh+THwovmVc2WxbU9jUqmKhJzAN6aMyp3dOLUxbPZxkCnF3WHrwafJMM0iufnZ+rca 53/6fGFg==; Received: from mailgw.kylinos.cn ([124.126.103.232]) by desiato.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qpKUx-00ENHx-0e for linux-arm-kernel@lists.infradead.org; Sun, 08 Oct 2023 03:30:41 +0000 X-UUID: 65fef9d365334aeb8b3bd23711c2f496-20231008 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.32,REQID:3ad2d6a7-5ef2-49fa-8a01-ac7228f711c0,IP:10, URL:0,TC:0,Content:0,EDM:0,RT:0,SF:-15,FILE:0,BULK:0,RULE:Release_Ham,ACTI ON:release,TS:-5 X-CID-INFO: VERSION:1.1.32,REQID:3ad2d6a7-5ef2-49fa-8a01-ac7228f711c0,IP:10,UR L:0,TC:0,Content:0,EDM:0,RT:0,SF:-15,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:-5 X-CID-META: VersionHash:5f78ec9,CLOUDID:d72ab3bf-14cc-44ca-b657-2d2783296e72,B ulkID:231008112927Q8RCSMWZ,BulkQuantity:0,Recheck:0,SF:38|24|17|19|44|102, TC:nil,Content:0,EDM:-3,IP:-2,URL:0,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0 ,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0 X-CID-BVR: 0,NGT X-CID-BAS: 0,NGT,0,_ X-CID-FACTOR: TF_CID_SPAM_FSD,TF_CID_SPAM_FSI,TF_CID_SPAM_SNR,TF_CID_SPAM_FAS X-UUID: 65fef9d365334aeb8b3bd23711c2f496-20231008 X-User: gehao@kylinos.cn Received: from localhost.localdomain [(116.128.244.171)] by mailgw (envelope-from ) (Generic MTA) with ESMTP id 1372250900; Sun, 08 Oct 2023 11:29:25 +0800 From: Hao Ge To: shawnguo@kernel.org, s.hauer@pengutronix.de Cc: kernel@pengutronix.de, festevam@gmail.com, linux-imx@nxp.com, christophe.jaillet@wanadoo.fr, robh@kernel.org, treding@nvidia.com, daniel.baluta@nxp.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, gehao618@163.com, Hao Ge Subject: [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() Date: Sun, 8 Oct 2023 11:29:08 +0800 Message-Id: <20231008032908.11448-1-gehao@kylinos.cn> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20231008_043034_917844_5E5AA008 X-CRM114-Status: UNSURE ( 9.69 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org dsp_chan->name and chan_name points to same block of memory, because dev_err still needs to be used it,so we need free it's memory after use to avoid use_after_free. Fixes: e527adfb9b7d ("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()") Signed-off-by: Hao Ge --- drivers/firmware/imx/imx-dsp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/imx/imx-dsp.c b/drivers/firmware/imx/imx-dsp.c index 508eab346fc6..a48a58e0c61f 100644 --- a/drivers/firmware/imx/imx-dsp.c +++ b/drivers/firmware/imx/imx-dsp.c @@ -114,11 +114,11 @@ static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc) dsp_chan->idx = i % 2; dsp_chan->ch = mbox_request_channel_byname(cl, chan_name); if (IS_ERR(dsp_chan->ch)) { - kfree(dsp_chan->name); ret = PTR_ERR(dsp_chan->ch); if (ret != -EPROBE_DEFER) dev_err(dev, "Failed to request mbox chan %s ret %d\n", chan_name, ret); + kfree(dsp_chan->name); goto out; } -- 2.25.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAA9CE95A91 for ; Sun, 8 Oct 2023 03:32:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344340AbjJHD3p (ORCPT ); Sat, 7 Oct 2023 23:29:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33954 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344300AbjJHD3o (ORCPT ); Sat, 7 Oct 2023 23:29:44 -0400 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D5977BD for ; Sat, 7 Oct 2023 20:29:38 -0700 (PDT) X-UUID: 65fef9d365334aeb8b3bd23711c2f496-20231008 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.32,REQID:3ad2d6a7-5ef2-49fa-8a01-ac7228f711c0,IP:10, URL:0,TC:0,Content:0,EDM:0,RT:0,SF:-15,FILE:0,BULK:0,RULE:Release_Ham,ACTI ON:release,TS:-5 X-CID-INFO: VERSION:1.1.32,REQID:3ad2d6a7-5ef2-49fa-8a01-ac7228f711c0,IP:10,UR L:0,TC:0,Content:0,EDM:0,RT:0,SF:-15,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:-5 X-CID-META: VersionHash:5f78ec9,CLOUDID:d72ab3bf-14cc-44ca-b657-2d2783296e72,B ulkID:231008112927Q8RCSMWZ,BulkQuantity:0,Recheck:0,SF:38|24|17|19|44|102, TC:nil,Content:0,EDM:-3,IP:-2,URL:0,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0 ,OSI:0,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0 X-CID-BVR: 0,NGT X-CID-BAS: 0,NGT,0,_ X-CID-FACTOR: TF_CID_SPAM_FSD,TF_CID_SPAM_FSI,TF_CID_SPAM_SNR,TF_CID_SPAM_FAS X-UUID: 65fef9d365334aeb8b3bd23711c2f496-20231008 X-User: gehao@kylinos.cn Received: from localhost.localdomain [(116.128.244.171)] by mailgw (envelope-from ) (Generic MTA) with ESMTP id 1372250900; Sun, 08 Oct 2023 11:29:25 +0800 From: Hao Ge To: shawnguo@kernel.org, s.hauer@pengutronix.de Cc: kernel@pengutronix.de, festevam@gmail.com, linux-imx@nxp.com, christophe.jaillet@wanadoo.fr, robh@kernel.org, treding@nvidia.com, daniel.baluta@nxp.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, gehao618@163.com, Hao Ge Subject: [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() Date: Sun, 8 Oct 2023 11:29:08 +0800 Message-Id: <20231008032908.11448-1-gehao@kylinos.cn> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org dsp_chan->name and chan_name points to same block of memory, because dev_err still needs to be used it,so we need free it's memory after use to avoid use_after_free. Fixes: e527adfb9b7d ("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()") Signed-off-by: Hao Ge --- drivers/firmware/imx/imx-dsp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/imx/imx-dsp.c b/drivers/firmware/imx/imx-dsp.c index 508eab346fc6..a48a58e0c61f 100644 --- a/drivers/firmware/imx/imx-dsp.c +++ b/drivers/firmware/imx/imx-dsp.c @@ -114,11 +114,11 @@ static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc) dsp_chan->idx = i % 2; dsp_chan->ch = mbox_request_channel_byname(cl, chan_name); if (IS_ERR(dsp_chan->ch)) { - kfree(dsp_chan->name); ret = PTR_ERR(dsp_chan->ch); if (ret != -EPROBE_DEFER) dev_err(dev, "Failed to request mbox chan %s ret %d\n", chan_name, ret); + kfree(dsp_chan->name); goto out; } -- 2.25.1