* [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()
@ 2023-10-08 3:29 Hao Ge
2023-10-09 11:07 ` Daniel Baluta
2023-10-10 2:33 ` Shawn Guo
0 siblings, 2 replies; 3+ messages in thread
From: Hao Ge @ 2023-10-08 3:29 UTC (permalink / raw)
To: shawnguo, s.hauer
Cc: kernel, festevam, linux-imx, christophe.jaillet, robh, treding,
daniel.baluta, linux-arm-kernel, linux-kernel, gehao618, Hao Ge
dsp_chan->name and chan_name points to same block of memory,
because dev_err still needs to be used it,so we need free
it's memory after use to avoid use_after_free.
Fixes: e527adfb9b7d ("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()")
Signed-off-by: Hao Ge <gehao@kylinos.cn>
---
drivers/firmware/imx/imx-dsp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/imx/imx-dsp.c b/drivers/firmware/imx/imx-dsp.c
index 508eab346fc6..a48a58e0c61f 100644
--- a/drivers/firmware/imx/imx-dsp.c
+++ b/drivers/firmware/imx/imx-dsp.c
@@ -114,11 +114,11 @@ static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc)
dsp_chan->idx = i % 2;
dsp_chan->ch = mbox_request_channel_byname(cl, chan_name);
if (IS_ERR(dsp_chan->ch)) {
- kfree(dsp_chan->name);
ret = PTR_ERR(dsp_chan->ch);
if (ret != -EPROBE_DEFER)
dev_err(dev, "Failed to request mbox chan %s ret %d\n",
chan_name, ret);
+ kfree(dsp_chan->name);
goto out;
}
--
2.25.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()
2023-10-08 3:29 [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() Hao Ge
@ 2023-10-09 11:07 ` Daniel Baluta
2023-10-10 2:33 ` Shawn Guo
1 sibling, 0 replies; 3+ messages in thread
From: Daniel Baluta @ 2023-10-09 11:07 UTC (permalink / raw)
To: Hao Ge
Cc: shawnguo, s.hauer, kernel, festevam, linux-imx,
christophe.jaillet, robh, treding, daniel.baluta,
linux-arm-kernel, linux-kernel, gehao618
On Sun, Oct 8, 2023 at 6:30 AM Hao Ge <gehao@kylinos.cn> wrote:
>
> dsp_chan->name and chan_name points to same block of memory,
> because dev_err still needs to be used it,so we need free
> it's memory after use to avoid use_after_free.
>
> Fixes: e527adfb9b7d ("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()")
> Signed-off-by: Hao Ge <gehao@kylinos.cn>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
> ---
> drivers/firmware/imx/imx-dsp.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/firmware/imx/imx-dsp.c b/drivers/firmware/imx/imx-dsp.c
> index 508eab346fc6..a48a58e0c61f 100644
> --- a/drivers/firmware/imx/imx-dsp.c
> +++ b/drivers/firmware/imx/imx-dsp.c
> @@ -114,11 +114,11 @@ static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc)
> dsp_chan->idx = i % 2;
> dsp_chan->ch = mbox_request_channel_byname(cl, chan_name);
> if (IS_ERR(dsp_chan->ch)) {
> - kfree(dsp_chan->name);
> ret = PTR_ERR(dsp_chan->ch);
> if (ret != -EPROBE_DEFER)
> dev_err(dev, "Failed to request mbox chan %s ret %d\n",
> chan_name, ret);
> + kfree(dsp_chan->name);
> goto out;
> }
>
> --
> 2.25.1
>
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels()
2023-10-08 3:29 [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() Hao Ge
2023-10-09 11:07 ` Daniel Baluta
@ 2023-10-10 2:33 ` Shawn Guo
1 sibling, 0 replies; 3+ messages in thread
From: Shawn Guo @ 2023-10-10 2:33 UTC (permalink / raw)
To: Hao Ge
Cc: s.hauer, kernel, festevam, linux-imx, christophe.jaillet, robh,
treding, daniel.baluta, linux-arm-kernel, linux-kernel, gehao618
On Sun, Oct 08, 2023 at 11:29:08AM +0800, Hao Ge wrote:
> dsp_chan->name and chan_name points to same block of memory,
> because dev_err still needs to be used it,so we need free
> it's memory after use to avoid use_after_free.
>
> Fixes: e527adfb9b7d ("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()")
> Signed-off-by: Hao Ge <gehao@kylinos.cn>
Applied, thanks!
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-10-10 2:33 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-10-08 3:29 [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() Hao Ge
2023-10-09 11:07 ` Daniel Baluta
2023-10-10 2:33 ` Shawn Guo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).