* [PATCH] TPM: Avoid reference to potentially freed memory
@ 2015-10-22 20:32 Christophe JAILLET
2015-10-23 7:37 ` Jarkko Sakkinen
0 siblings, 1 reply; 6+ messages in thread
From: Christophe JAILLET @ 2015-10-22 20:32 UTC (permalink / raw)
To: peterhuewe, tpmdd, jarkko.sakkinen
Cc: tpmdd-devel, linux-kernel, kernel-janitors, Christophe JAILLET
Reference to the 'np' node is dropped before dereferencing the 'sizep' and
'basep' pointers, which could by then point to junk if the node has been
freed.
Refactor code to call 'of_node_pup' later.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
drivers/char/tpm/tpm_of.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/char/tpm/tpm_of.c b/drivers/char/tpm/tpm_of.c
index 1141456..570f30c 100644
--- a/drivers/char/tpm/tpm_of.c
+++ b/drivers/char/tpm/tpm_of.c
@@ -53,17 +53,18 @@ int read_log(struct tpm_bios_log *log)
goto cleanup_eio;
}
- of_node_put(np);
log->bios_event_log = kmalloc(*sizep, GFP_KERNEL);
if (!log->bios_event_log) {
pr_err("%s: ERROR - Not enough memory for BIOS measurements\n",
__func__);
+ of_node_put(np);
return -ENOMEM;
}
log->bios_event_log_end = log->bios_event_log + *sizep;
memcpy(log->bios_event_log, __va(*basep), *sizep);
+ of_node_put(np);
return 0;
--
2.1.4
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] TPM: Avoid reference to potentially freed memory
2015-10-22 20:32 [PATCH] TPM: Avoid reference to potentially freed memory Christophe JAILLET
@ 2015-10-23 7:37 ` Jarkko Sakkinen
2015-10-27 10:27 ` [tpmdd-devel] " Jarkko Sakkinen
0 siblings, 1 reply; 6+ messages in thread
From: Jarkko Sakkinen @ 2015-10-23 7:37 UTC (permalink / raw)
To: Christophe JAILLET
Cc: peterhuewe, tpmdd, tpmdd-devel, linux-kernel, kernel-janitors
On Thu, Oct 22, 2015 at 10:32:41PM +0200, Christophe JAILLET wrote:
> Reference to the 'np' node is dropped before dereferencing the 'sizep' and
> 'basep' pointers, which could by then point to junk if the node has been
> freed.
>
> Refactor code to call 'of_node_pup' later.
>
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
LGTM.
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> ---
> drivers/char/tpm/tpm_of.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/char/tpm/tpm_of.c b/drivers/char/tpm/tpm_of.c
> index 1141456..570f30c 100644
> --- a/drivers/char/tpm/tpm_of.c
> +++ b/drivers/char/tpm/tpm_of.c
> @@ -53,17 +53,18 @@ int read_log(struct tpm_bios_log *log)
> goto cleanup_eio;
> }
>
> - of_node_put(np);
> log->bios_event_log = kmalloc(*sizep, GFP_KERNEL);
> if (!log->bios_event_log) {
> pr_err("%s: ERROR - Not enough memory for BIOS measurements\n",
> __func__);
> + of_node_put(np);
> return -ENOMEM;
> }
>
> log->bios_event_log_end = log->bios_event_log + *sizep;
>
> memcpy(log->bios_event_log, __va(*basep), *sizep);
> + of_node_put(np);
>
> return 0;
>
> --
> 2.1.4
>
/Jarkko
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [tpmdd-devel] [PATCH] TPM: Avoid reference to potentially freed memory
2015-10-23 7:37 ` Jarkko Sakkinen
@ 2015-10-27 10:27 ` Jarkko Sakkinen
2015-10-29 6:12 ` Marion & Christophe JAILLET
0 siblings, 1 reply; 6+ messages in thread
From: Jarkko Sakkinen @ 2015-10-27 10:27 UTC (permalink / raw)
To: Christophe JAILLET; +Cc: kernel-janitors, tpmdd-devel, linux-kernel
On Fri, Oct 23, 2015 at 10:37:33AM +0300, Jarkko Sakkinen wrote:
> On Thu, Oct 22, 2015 at 10:32:41PM +0200, Christophe JAILLET wrote:
> > Reference to the 'np' node is dropped before dereferencing the 'sizep' and
> > 'basep' pointers, which could by then point to junk if the node has been
> > freed.
> >
> > Refactor code to call 'of_node_pup' later.
> >
> > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
>
> LGTM.
Is there anyone able to provide Tested-by for this?
Christophe, were you able to reproduce the crash (insmod/rmmod couple
of times maybe?) and validate that it was gone after fixing the bug?
> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
/Jarkko
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [tpmdd-devel] [PATCH] TPM: Avoid reference to potentially freed memory
2015-10-27 10:27 ` [tpmdd-devel] " Jarkko Sakkinen
@ 2015-10-29 6:12 ` Marion & Christophe JAILLET
2015-10-29 10:48 ` Jarkko Sakkinen
0 siblings, 1 reply; 6+ messages in thread
From: Marion & Christophe JAILLET @ 2015-10-29 6:12 UTC (permalink / raw)
To: Jarkko Sakkinen; +Cc: kernel-janitors, tpmdd-devel, linux-kernel
Le 27/10/2015 11:27, Jarkko Sakkinen a écrit :
> On Fri, Oct 23, 2015 at 10:37:33AM +0300, Jarkko Sakkinen wrote:
>> On Thu, Oct 22, 2015 at 10:32:41PM +0200, Christophe JAILLET wrote:
>>> Reference to the 'np' node is dropped before dereferencing the 'sizep' and
>>> 'basep' pointers, which could by then point to junk if the node has been
>>> freed.
>>>
>>> Refactor code to call 'of_node_pup' later.
>>>
>>> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
>> LGTM.
> Is there anyone able to provide Tested-by for this?
>
> Christophe, were you able to reproduce the crash (insmod/rmmod couple
> of times maybe?) and validate that it was gone after fixing the bug?
Hi,
no, I never triggered the bug.
This is just something noticed while looking at potential issues related
to incorrect use of 'of_node_pup'.
I only compile tested the patch.
Best regards,
CJ
>
>> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> /Jarkko
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [tpmdd-devel] [PATCH] TPM: Avoid reference to potentially freed memory
2015-10-29 6:12 ` Marion & Christophe JAILLET
@ 2015-10-29 10:48 ` Jarkko Sakkinen
2015-10-30 11:38 ` Jarkko Sakkinen
0 siblings, 1 reply; 6+ messages in thread
From: Jarkko Sakkinen @ 2015-10-29 10:48 UTC (permalink / raw)
To: Marion & Christophe JAILLET
Cc: kernel-janitors, tpmdd-devel, linux-kernel
On Thu, Oct 29, 2015 at 07:12:01AM +0100, Marion & Christophe JAILLET wrote:
>
>
> Le 27/10/2015 11:27, Jarkko Sakkinen a écrit :
> >On Fri, Oct 23, 2015 at 10:37:33AM +0300, Jarkko Sakkinen wrote:
> >>On Thu, Oct 22, 2015 at 10:32:41PM +0200, Christophe JAILLET wrote:
> >>>Reference to the 'np' node is dropped before dereferencing the 'sizep' and
> >>>'basep' pointers, which could by then point to junk if the node has been
> >>>freed.
> >>>
> >>>Refactor code to call 'of_node_pup' later.
> >>>
> >>>Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> >>LGTM.
> >Is there anyone able to provide Tested-by for this?
> >
> >Christophe, were you able to reproduce the crash (insmod/rmmod couple
> >of times maybe?) and validate that it was gone after fixing the bug?
>
> Hi,
> no, I never triggered the bug.
> This is just something noticed while looking at potential issues related to
> incorrect use of 'of_node_pup'.
> I only compile tested the patch.
The fix is so obvious that I see no reason not to include it. Thanks for
the good work.
> Best regards,
> CJ
/Jarkko
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [tpmdd-devel] [PATCH] TPM: Avoid reference to potentially freed memory
2015-10-29 10:48 ` Jarkko Sakkinen
@ 2015-10-30 11:38 ` Jarkko Sakkinen
0 siblings, 0 replies; 6+ messages in thread
From: Jarkko Sakkinen @ 2015-10-30 11:38 UTC (permalink / raw)
To: Marion & Christophe JAILLET
Cc: kernel-janitors, tpmdd-devel, linux-kernel
On Thu, Oct 29, 2015 at 12:48:44PM +0200, Jarkko Sakkinen wrote:
> On Thu, Oct 29, 2015 at 07:12:01AM +0100, Marion & Christophe JAILLET wrote:
> >
> >
> > Le 27/10/2015 11:27, Jarkko Sakkinen a écrit :
> > >On Fri, Oct 23, 2015 at 10:37:33AM +0300, Jarkko Sakkinen wrote:
> > >>On Thu, Oct 22, 2015 at 10:32:41PM +0200, Christophe JAILLET wrote:
> > >>>Reference to the 'np' node is dropped before dereferencing the 'sizep' and
> > >>>'basep' pointers, which could by then point to junk if the node has been
> > >>>freed.
> > >>>
> > >>>Refactor code to call 'of_node_pup' later.
> > >>>
> > >>>Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> > >>LGTM.
> > >Is there anyone able to provide Tested-by for this?
> > >
> > >Christophe, were you able to reproduce the crash (insmod/rmmod couple
> > >of times maybe?) and validate that it was gone after fixing the bug?
> >
> > Hi,
> > no, I never triggered the bug.
> > This is just something noticed while looking at potential issues related to
> > incorrect use of 'of_node_pup'.
> > I only compile tested the patch.
>
> The fix is so obvious that I see no reason not to include it. Thanks for
> the good work.
I'm getting
$ git am ~/tmp/of-fix.patch
Applying: TPM: Avoid reference to potentially freed memory
error: patch failed: drivers/char/tpm/tpm_of.c:53
error: drivers/char/tpm/tpm_of.c: patch does not apply
Patch failed at 0001 TPM: Avoid reference to potentially freed memory
The copy of the patch that failed is found in:
/home/jsakkine/projects/tpm2/git/linux-tpmdd/.git/rebase-apply/patch
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am
--abort".
I'm applying this against Linus tree (4.3-rc7).
/Jarkko
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-10-30 11:38 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-10-22 20:32 [PATCH] TPM: Avoid reference to potentially freed memory Christophe JAILLET
2015-10-23 7:37 ` Jarkko Sakkinen
2015-10-27 10:27 ` [tpmdd-devel] " Jarkko Sakkinen
2015-10-29 6:12 ` Marion & Christophe JAILLET
2015-10-29 10:48 ` Jarkko Sakkinen
2015-10-30 11:38 ` Jarkko Sakkinen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).