[PATCH v1] drivers:testing:Handle possible memory leaks

[PATCH v1] drivers:testing:Handle possible memory leaks

[Yang Ruibin]

When copy_from_user() fails, -EFAULT is returned without
releasing the memory previously allocated by kmalloc().

Signed-off-by: Yang Ruibin <11162571@vivo.com>
---
 drivers/thermal/testing/command.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/thermal/testing/command.c b/drivers/thermal/testing/command.c
index 6771eb7b1..7868caee3 100644
--- a/drivers/thermal/testing/command.c
+++ b/drivers/thermal/testing/command.c
@@ -151,6 +151,7 @@ static ssize_t tt_command_process(struct dentry *dentry, const char __user *user
 		return -ENOMEM;
 
 	if (copy_from_user(buf, user_buf, count))
+		kfree(buf);
 		return -EFAULT;
 
 	buf[count] = '\0';
-- 
2.34.1

[PATCH v1] drivers:testing:Handle possible memory leaks

[Yang Ruibin]

When copy_from_user() fails, -EFAULT is returned without
releasing the memory previously allocated by kmalloc().

Signed-off-by: Yang Ruibin <11162571@vivo.com>
---
 drivers/thermal/testing/command.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/thermal/testing/command.c b/drivers/thermal/testing/command.c
index 7868caee3..b95bcb94e 100644
--- a/drivers/thermal/testing/command.c
+++ b/drivers/thermal/testing/command.c
@@ -150,9 +150,10 @@ static ssize_t tt_command_process(struct dentry *dentry, const char __user *user
 	if (!buf)
 		return -ENOMEM;
 
-	if (copy_from_user(buf, user_buf, count))
+	if (copy_from_user(buf, user_buf, count)) {
+		kfree(buf);
 		return -EFAULT;
+	}
 
 	buf[count] = '\0';
 	strim(buf);
-- 
2.34.1

Re: [PATCH v1] drivers:testing:Handle possible memory leaks

[Rafael J. Wysocki]

On Thu, Aug 22, 2024 at 5:39 AM Yang Ruibin <11162571@vivo.com> wrote:
>
> When copy_from_user() fails, -EFAULT is returned without
> releasing the memory previously allocated by kmalloc().
>
> Signed-off-by: Yang Ruibin <11162571@vivo.com>
> ---
>  drivers/thermal/testing/command.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/thermal/testing/command.c b/drivers/thermal/testing/command.c
> index 7868caee3..b95bcb94e 100644
> --- a/drivers/thermal/testing/command.c
> +++ b/drivers/thermal/testing/command.c
> @@ -150,9 +150,10 @@ static ssize_t tt_command_process(struct dentry *dentry, const char __user *user
>         if (!buf)
>                 return -ENOMEM;
>
> -       if (copy_from_user(buf, user_buf, count))
> +       if (copy_from_user(buf, user_buf, count)) {
> +               kfree(buf);
>                 return -EFAULT;
> +       }
>
>         buf[count] = '\0';
>         strim(buf);
> --

Have you missed the __free() annotation on "buf"?

Re: [PATCH v1] drivers:testing:Handle possible memory leaks

[kernel test robot]

Hi Yang,

kernel test robot noticed the following build warnings:

[auto build test WARNING on next-20240821]
[cannot apply to rafael-pm/thermal v6.11-rc4 v6.11-rc3 v6.11-rc2 linus/master v6.11-rc4]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Yang-Ruibin/drivers-testing-Handle-possible-memory-leaks/20240822-112305
base:   next-20240821
patch link:    https://lore.kernel.org/r/20240822032108.1223332-1-11162571%40vivo.com
patch subject: [PATCH v1] drivers:testing:Handle possible memory leaks
config: i386-allyesconfig (https://download.01.org/0day-ci/archive/20240825/202408250314.w7DgoEPI-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240825/202408250314.w7DgoEPI-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202408250314.w7DgoEPI-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/thermal/testing/command.c: In function 'tt_command_process':
>> drivers/thermal/testing/command.c:153:9: warning: this 'if' clause does not guard... [-Wmisleading-indentation]
     153 |         if (copy_from_user(buf, user_buf, count))
         |         ^~
   drivers/thermal/testing/command.c:155:17: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the 'if'
     155 |                 return -EFAULT;
         |                 ^~~~~~


vim +/if +153 drivers/thermal/testing/command.c

7801e360656c57 Rafael J. Wysocki 2024-08-02  141  
7801e360656c57 Rafael J. Wysocki 2024-08-02  142  static ssize_t tt_command_process(struct dentry *dentry, const char __user *user_buf,
7801e360656c57 Rafael J. Wysocki 2024-08-02  143  				  size_t count)
7801e360656c57 Rafael J. Wysocki 2024-08-02  144  {
7801e360656c57 Rafael J. Wysocki 2024-08-02  145  	char *buf __free(kfree);
7801e360656c57 Rafael J. Wysocki 2024-08-02  146  	char *arg;
7801e360656c57 Rafael J. Wysocki 2024-08-02  147  	int i;
7801e360656c57 Rafael J. Wysocki 2024-08-02  148  
7801e360656c57 Rafael J. Wysocki 2024-08-02  149  	buf = kmalloc(count + 1, GFP_KERNEL);
7801e360656c57 Rafael J. Wysocki 2024-08-02  150  	if (!buf)
7801e360656c57 Rafael J. Wysocki 2024-08-02  151  		return -ENOMEM;
7801e360656c57 Rafael J. Wysocki 2024-08-02  152  
7801e360656c57 Rafael J. Wysocki 2024-08-02 @153  	if (copy_from_user(buf, user_buf, count))
98706c6ade7c2e Yang Ruibin       2024-08-22  154  		kfree(buf);
7801e360656c57 Rafael J. Wysocki 2024-08-02  155  		return -EFAULT;
7801e360656c57 Rafael J. Wysocki 2024-08-02  156  
7801e360656c57 Rafael J. Wysocki 2024-08-02  157  	buf[count] = '\0';
7801e360656c57 Rafael J. Wysocki 2024-08-02  158  	strim(buf);
7801e360656c57 Rafael J. Wysocki 2024-08-02  159  
7801e360656c57 Rafael J. Wysocki 2024-08-02  160  	arg = strstr(buf, ":");
7801e360656c57 Rafael J. Wysocki 2024-08-02  161  	if (arg) {
7801e360656c57 Rafael J. Wysocki 2024-08-02  162  		*arg = '\0';
7801e360656c57 Rafael J. Wysocki 2024-08-02  163  		arg++;
7801e360656c57 Rafael J. Wysocki 2024-08-02  164  	}
7801e360656c57 Rafael J. Wysocki 2024-08-02  165  
7801e360656c57 Rafael J. Wysocki 2024-08-02  166  	for (i = 0; i < ARRAY_SIZE(tt_command_strings); i++) {
7801e360656c57 Rafael J. Wysocki 2024-08-02  167  		if (!strcmp(buf, tt_command_strings[i]))
7801e360656c57 Rafael J. Wysocki 2024-08-02  168  			return tt_command_exec(i, arg);
7801e360656c57 Rafael J. Wysocki 2024-08-02  169  	}
7801e360656c57 Rafael J. Wysocki 2024-08-02  170  
7801e360656c57 Rafael J. Wysocki 2024-08-02  171  	return -EINVAL;
7801e360656c57 Rafael J. Wysocki 2024-08-02  172  }
7801e360656c57 Rafael J. Wysocki 2024-08-02  173  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v1] drivers:testing:Handle possible memory leaks

[kernel test robot]

Hi Yang,

kernel test robot noticed the following build warnings:

[auto build test WARNING on next-20240821]
[cannot apply to rafael-pm/thermal v6.11-rc4 v6.11-rc3 v6.11-rc2 linus/master v6.11-rc4]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Yang-Ruibin/drivers-testing-Handle-possible-memory-leaks/20240822-112305
base:   next-20240821
patch link:    https://lore.kernel.org/r/20240822032108.1223332-1-11162571%40vivo.com
patch subject: [PATCH v1] drivers:testing:Handle possible memory leaks
config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240825/202408250520.ZWvQ82gO-lkp@intel.com/config)
compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240825/202408250520.ZWvQ82gO-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202408250520.ZWvQ82gO-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> drivers/thermal/testing/command.c:155:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
     155 |                 return -EFAULT;
         |                 ^
   drivers/thermal/testing/command.c:153:2: note: previous statement is here
     153 |         if (copy_from_user(buf, user_buf, count))
         |         ^
   1 warning generated.


vim +/if +155 drivers/thermal/testing/command.c

7801e360656c57 Rafael J. Wysocki 2024-08-02  141  
7801e360656c57 Rafael J. Wysocki 2024-08-02  142  static ssize_t tt_command_process(struct dentry *dentry, const char __user *user_buf,
7801e360656c57 Rafael J. Wysocki 2024-08-02  143  				  size_t count)
7801e360656c57 Rafael J. Wysocki 2024-08-02  144  {
7801e360656c57 Rafael J. Wysocki 2024-08-02  145  	char *buf __free(kfree);
7801e360656c57 Rafael J. Wysocki 2024-08-02  146  	char *arg;
7801e360656c57 Rafael J. Wysocki 2024-08-02  147  	int i;
7801e360656c57 Rafael J. Wysocki 2024-08-02  148  
7801e360656c57 Rafael J. Wysocki 2024-08-02  149  	buf = kmalloc(count + 1, GFP_KERNEL);
7801e360656c57 Rafael J. Wysocki 2024-08-02  150  	if (!buf)
7801e360656c57 Rafael J. Wysocki 2024-08-02  151  		return -ENOMEM;
7801e360656c57 Rafael J. Wysocki 2024-08-02  152  
7801e360656c57 Rafael J. Wysocki 2024-08-02  153  	if (copy_from_user(buf, user_buf, count))
98706c6ade7c2e Yang Ruibin       2024-08-22  154  		kfree(buf);
7801e360656c57 Rafael J. Wysocki 2024-08-02 @155  		return -EFAULT;
7801e360656c57 Rafael J. Wysocki 2024-08-02  156  
7801e360656c57 Rafael J. Wysocki 2024-08-02  157  	buf[count] = '\0';
7801e360656c57 Rafael J. Wysocki 2024-08-02  158  	strim(buf);
7801e360656c57 Rafael J. Wysocki 2024-08-02  159  
7801e360656c57 Rafael J. Wysocki 2024-08-02  160  	arg = strstr(buf, ":");
7801e360656c57 Rafael J. Wysocki 2024-08-02  161  	if (arg) {
7801e360656c57 Rafael J. Wysocki 2024-08-02  162  		*arg = '\0';
7801e360656c57 Rafael J. Wysocki 2024-08-02  163  		arg++;
7801e360656c57 Rafael J. Wysocki 2024-08-02  164  	}
7801e360656c57 Rafael J. Wysocki 2024-08-02  165  
7801e360656c57 Rafael J. Wysocki 2024-08-02  166  	for (i = 0; i < ARRAY_SIZE(tt_command_strings); i++) {
7801e360656c57 Rafael J. Wysocki 2024-08-02  167  		if (!strcmp(buf, tt_command_strings[i]))
7801e360656c57 Rafael J. Wysocki 2024-08-02  168  			return tt_command_exec(i, arg);
7801e360656c57 Rafael J. Wysocki 2024-08-02  169  	}
7801e360656c57 Rafael J. Wysocki 2024-08-02  170  
7801e360656c57 Rafael J. Wysocki 2024-08-02  171  	return -EINVAL;
7801e360656c57 Rafael J. Wysocki 2024-08-02  172  }
7801e360656c57 Rafael J. Wysocki 2024-08-02  173  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki