stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Daniel Baluta <daniel.baluta@nxp.com>,
	Stefan Wahren <stefan.wahren@i2se.com>,
	Mark Brown <broonie@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.19 009/158] regmap: debugfs: Fix memory leak in regmap_debugfs_init
Date: Mon, 15 Jul 2019 09:36:54 -0400	[thread overview]
Message-ID: <20190715133923.2890-9-sashal@kernel.org> (raw)
In-Reply-To: <20190715133923.2890-1-sashal@kernel.org>

From: Daniel Baluta <daniel.baluta@nxp.com>

[ Upstream commit 2899872b627e99b7586fe3b6c9f861da1b4d5072 ]

As detected by kmemleak running on i.MX6ULL board:

nreferenced object 0xd8366600 (size 64):
  comm "swapper/0", pid 1, jiffies 4294937370 (age 933.220s)
  hex dump (first 32 bytes):
    64 75 6d 6d 79 2d 69 6f 6d 75 78 63 2d 67 70 72  dummy-iomuxc-gpr
    40 32 30 65 34 30 30 30 00 e3 f3 ab fe d1 1b dd  @20e4000........
  backtrace:
    [<b0402aec>] kasprintf+0x2c/0x54
    [<a6fbad2c>] regmap_debugfs_init+0x7c/0x31c
    [<9c8d91fa>] __regmap_init+0xb5c/0xcf4
    [<5b1c3d2a>] of_syscon_register+0x164/0x2c4
    [<596a5d80>] syscon_node_to_regmap+0x64/0x90
    [<49bd597b>] imx6ul_init_machine+0x34/0xa0
    [<250a4dac>] customize_machine+0x1c/0x30
    [<2d19fdaf>] do_one_initcall+0x7c/0x398
    [<e6084469>] kernel_init_freeable+0x328/0x448
    [<168c9101>] kernel_init+0x8/0x114
    [<913268aa>] ret_from_fork+0x14/0x20
    [<ce7b131a>] 0x0

Root cause is that map->debugfs_name is allocated using kasprintf
and then the pointer is lost by assigning it other memory address.

Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/regmap/regmap-debugfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 87b562e49a43..c9687c8b2347 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -575,6 +575,8 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
 	}
 
 	if (!strcmp(name, "dummy")) {
+		kfree(map->debugfs_name);
+
 		map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d",
 						dummy_index);
 		name = map->debugfs_name;
-- 
2.20.1


  parent reply	other threads:[~2019-07-15 13:40 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-15 13:36 [PATCH AUTOSEL 4.19 001/158] wil6210: fix potential out-of-bounds read Sasha Levin
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 002/158] ath10k: Do not send probe response template for mesh Sasha Levin
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 003/158] ath9k: Check for errors when reading SREV register Sasha Levin
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 004/158] ath6kl: add some bounds checking Sasha Levin
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 005/158] ath10k: add peer id check in ath10k_peer_find_by_id Sasha Levin
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 006/158] x86/tsc: Use CPUID.0x16 to calculate missing crystal frequency Sasha Levin
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 007/158] wil6210: fix spurious interrupts in 3-msi Sasha Levin
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 008/158] ath: DFS JP domain W56 fixed pulse type 3 RADAR detection Sasha Levin
2019-07-15 13:36 ` Sasha Levin [this message]
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 010/158] batman-adv: fix for leaked TVLV handler Sasha Levin
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 011/158] media: dvb: usb: fix use after free in dvb_usb_device_exit Sasha Levin
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 012/158] media: spi: IR LED: add missing of table registration Sasha Levin
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 013/158] crypto: talitos - fix skcipher failure due to wrong output IV Sasha Levin
2019-07-15 13:36 ` [PATCH AUTOSEL 4.19 014/158] media: ov7740: avoid invalid framesize setting Sasha Levin
2019-07-15 13:37 ` [PATCH AUTOSEL 4.19 015/158] media: marvell-ccic: fix DMA s/g desc number calculation Sasha Levin
  -- strict thread matches above, loose matches on Subject: below --
2019-07-15 14:15 [PATCH AUTOSEL 4.19 001/158] wil6210: fix potential out-of-bounds read Sasha Levin
2019-07-15 14:15 ` [PATCH AUTOSEL 4.19 009/158] regmap: debugfs: Fix memory leak in regmap_debugfs_init Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190715133923.2890-9-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=broonie@kernel.org \
    --cc=daniel.baluta@nxp.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=stefan.wahren@i2se.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).