linux-gpio.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [bug report] pinctrl: berlin: Don't leak memory if krealloc() fails
@ 2016-10-12  8:14 Dan Carpenter
  2016-10-12  8:30 ` Johannes Thumshirn
  0 siblings, 1 reply; 10+ messages in thread
From: Dan Carpenter @ 2016-10-12  8:14 UTC (permalink / raw)
  To: jthumshirn; +Cc: linux-gpio

Hello Johannes Thumshirn,

The patch e1547af8c059: "pinctrl: berlin: Don't leak memory if
krealloc() fails" from Sep 30, 2016, leads to the following static
checker warning:

	drivers/pinctrl/berlin/berlin.c:244 berlin_pinctrl_build_state()
	warn: passing devm_ allocated variable to kfree. 'pctrl->functions'

drivers/pinctrl/berlin/berlin.c
   221  
   222          /* we will reallocate later */
   223          pctrl->functions = devm_kzalloc(&pdev->dev,
   224                                          max_functions * sizeof(*pctrl->functions),
   225                                          GFP_KERNEL);
   226          if (!pctrl->functions)
   227                  return -ENOMEM;
   228  
   229          /* register all functions */
   230          for (i = 0; i < pctrl->desc->ngroups; i++) {
   231                  desc_group = pctrl->desc->groups + i;
   232                  desc_function = desc_group->functions;
   233  
   234                  while (desc_function->name) {
   235                          berlin_pinctrl_add_function(pctrl, desc_function->name);
   236                          desc_function++;
   237                  }
   238          }
   239  
   240          functions = krealloc(pctrl->functions,
   241                               pctrl->nfunctions * sizeof(*pctrl->functions),
   242                               GFP_KERNEL);
   243          if (!functions) {
   244                  kfree(pctrl->functions);

This will lead to a double free.

   245                  return -ENOMEM;
   246          }
   247          pctrl->functions = functions;

I'm really concerned about this generally.  It's like we can't tell if
pctrl->functions is a managed allocation or not, and I can't immediately
see where it is freed when it's unmanaged.

   248  

regards,
dan carpenter

^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2016-10-18 14:12 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-10-12  8:14 [bug report] pinctrl: berlin: Don't leak memory if krealloc() fails Dan Carpenter
2016-10-12  8:30 ` Johannes Thumshirn
2016-10-12  8:45   ` Dan Carpenter
2016-10-12  9:44     ` Johannes Thumshirn
2016-10-12 11:19       ` Dan Carpenter
2016-10-12 12:36         ` Johannes Thumshirn
2016-10-12 17:06           ` Dan Carpenter
2016-10-13 13:09             ` Johannes Thumshirn
2016-10-18 12:34               ` Linus Walleij
2016-10-18 14:12                 ` Johannes Thumshirn

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).