From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S933121AbcKJNSp (ORCPT <rfc822;w@1wt.eu>);
        Thu, 10 Nov 2016 08:18:45 -0500
Received: from mout.kundenserver.de ([217.72.192.74]:52185 "EHLO
        mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S932336AbcKJNSn (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Thu, 10 Nov 2016 08:18:43 -0500
From: Arnd Bergmann <arnd@arndb.de>
To: Jann Horn <jann@thejh.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Sudip Mukherjee <sudipm.mukherjee@gmail.com>,
        linux-kernel@vger.kernel.org, linux-parport@lists.infradead.org,
        Andy Lutomirski <luto@amacapital.net>
Subject: Re: [PATCH v2] ppdev: fix double-free of pp->pdev->name
Date: Thu, 10 Nov 2016 14:18:12 +0100
Message-ID: <2721049.iK2v6rcyvW@wuerfel>
User-Agent: KMail/5.1.3 (Linux/4.4.0-34-generic; KDE/5.18.0; x86_64; ; )
In-Reply-To: <1477865964-4497-1-git-send-email-jann@thejh.net>
References: <1477865964-4497-1-git-send-email-jann@thejh.net>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
X-Provags-ID: V03:K0:Rr0SJAod9LWARhfxPlPn85WFbdLLZ73OSR8cYoqhuwFaq8C121W
 zPsizFQAoZ4gZqLryGciaVouL/0aSMqp3sRiFeRqd2BtrjehJXjKnKe4IKG2GvdE+ea7CZ3
 uPaQ+FSSdeHiHbjrdMDy51Oj0oIVafTpnoPu1yadPMrFksp+Hw9OQ4IjEjIHP9DRJkMcS+u
 b1ILuspSoVxPDomf8oSOw==
X-UI-Out-Filterresults: notjunk:1;V01:K0:2Qdss6OUbcU=:5afTDW33bPvJbuOKEQqNh8
 uBFx+4x0CltQVJht2LxYjQfVieSzIPfVz7TzkkUiYpO00Lqqs3yrkUFooUAfHwW4In+VVbbj2
 sa7o/yI0qHwkbxarjsurRW+YYxqozrbV1G4FEYYsDaWzAW87tKaY2T1suz34etzafH8qvt4/g
 NjAP9WHcjL/60myzsklILiST/4tiIp9FqHYLMXn09U2IsXsxCJxoyh3e+7vvegY8y9neFVFxp
 OTgR7R04IZHLanqmdKHZQhrzaNhV8Zq4p9kHi7XnPs88oSs46kCxjS/MzWl8xNOQZBKMJL+WI
 ITPKaMQCwnUwa2Wmgj8/51RjLTRQtdr7PFnlzY7xEZnFVCzkrUgpYhhr8UCBg/Sd/YE4eNAWv
 QCkoaVor3yqEM7oeo8ptad60wzEIc0k3FpHsknMrnqbVU5BUEsLkr6wBdBZe1Axvf9y3aWFUG
 rdvhzEALQPDQXt81lghSVVrEGnQuAu7KHxidzHRMJJDltUwdxUttxu6TKs+f45MAFTPnl3KTL
 WZqvpi9sucgb5yXbGbhy4KnrHHzwjN07uwO8+wGddk/uGzPoaDpCMREfYoa9KSBrZH18t6m/K
 QAg+egmzcoFGfTBi2qc2kh5VMkNtu26TfNBDeYlb4YlLANMyhPTuojY8+nS+yL0ljNjLeyL/j
 ClUvLvbH+2qU5sZAkWzW9gQ2VLe13QuyckutgISF72Bjcns7R5VgLnDiyEIglSE0odByqx1wx
 VVKpCI5uFXhaef9C
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sunday, October 30, 2016 11:19:24 PM CET Jann Horn wrote:
> diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
> index d23368874710..6af1ce04b3da 100644
> --- a/drivers/char/ppdev.c
> +++ b/drivers/char/ppdev.c
> @@ -748,10 +748,7 @@ static int pp_release(struct inode *inode, struct file *file)
>         }
>  
>         if (pp->pdev) {
> -               const char *name = pp->pdev->name;
> -
>                 parport_unregister_device(pp->pdev);
> -               kfree(name);
>                 pp->pdev = NULL;
>                 pr_debug(CHRDEV "%x: unregistered pardevice\n", minor);
>         }
> 

I took a closer look at this and found that we also leak the name
that is passed in register_device() in the same file:

        name = kasprintf(GFP_KERNEL, CHRDEV "%x", minor);
...
        pdev = parport_register_dev_model(port, name, &ppdev_cb, minor);

parport_register_dev_model() copies the name using kstrdup() and
we should really free it after parport_register_dev_model().

It's not a huge problem, just leaking a few bytes of memory, but
the extra kfree() probably came from this confusion.

	Arnd