From patchwork Thu Jan 14 07:11:28 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lee Jones X-Patchwork-Id: 59711 Delivered-To: patch@linaro.org Received: by 10.112.130.2 with SMTP id oa2csp3831130lbb; Wed, 13 Jan 2016 23:14:34 -0800 (PST) X-Received: by 10.98.66.74 with SMTP id p71mr3737802pfa.105.1452755674701; Wed, 13 Jan 2016 23:14:34 -0800 (PST) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 2si7547578pfj.77.2016.01.13.23.14.34; Wed, 13 Jan 2016 23:14:34 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dkim=pass header.i=@linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752428AbcANHOd (ORCPT + 29 others); Thu, 14 Jan 2016 02:14:33 -0500 Received: from mail-wm0-f46.google.com ([74.125.82.46]:33248 "EHLO mail-wm0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750922AbcANHNl (ORCPT ); Thu, 14 Jan 2016 02:13:41 -0500 Received: by mail-wm0-f46.google.com with SMTP id f206so328870195wmf.0 for ; Wed, 13 Jan 2016 23:13:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=/xwXBVGSSITblmBEuwmDMmB47nFt32dq1P4UdnlHGFM=; b=gHz43KKpJrNs0erGtq5jQNTKeTuHE1U8RRod3WjWb+g3XP8+5cNlu5ujZLxY2oO+TU Pc4q32EWO1tRFewE7hDWljRX281ORKPP6UwkDrcmBxIMGXB0QMMrzWnvYL5izXCZe3DA CYi68G8vHpW/VueJO997Lzq9nIWW/5QjezPXY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=/xwXBVGSSITblmBEuwmDMmB47nFt32dq1P4UdnlHGFM=; b=BurAXwY5sYpOWRSRAqprgWTDR7sPHzJB0+hzUcpbAWX51RopgMa6eq02esgbX4HPcC UPs741JyvDPybXeYtvgTU37uTgN92bhi4Y8BeiF9lY361Xv7Ustq1sKtOFcx/Ii5hHu5 mundXYwqpWO56jBeCusECyXpH5KXToJq5aFu0AooeELzs/nF5pmrVUACG3bwVmq1ePQR DJW8Ky4dyTjDw0zaZIwv99SvlXF5z7nRb21KJ5GC0GhPOfQLRbnaBaUgItjTA6Pdms/W ChrFJuTRO1zxNqD36jlvOFPqxQ8bwpWFq8gxKJHC5NU0GxTqLlOulF1SYxEkM+IF+JQs eMaw== X-Gm-Message-State: ALoCoQmmSqLqmmQhUEHmAHPwHORkwkbso0MpDPsnuyc8bYzKL4XxSFlcK5254MKiG2Ui6MNIweDYjWwGTVBiFlXRRISiZA5tvA== X-Received: by 10.28.68.68 with SMTP id r65mr3117490wma.95.1452755620045; Wed, 13 Jan 2016 23:13:40 -0800 (PST) Received: from localhost.localdomain ([217.46.108.250]) by smtp.gmail.com with ESMTPSA id c185sm23828522wma.5.2016.01.13.23.13.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 13 Jan 2016 23:13:39 -0800 (PST) From: Lee Jones To: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Cc: kernel@stlinux.com, maxime.coquelin@st.com, jassisinghbrar@gmail.com, dan.carpenter@oracle.com, seraphin.bonnaffe@st.com, Lee Jones Subject: [PATCH 3/4] mailbox: mailbox-test: Prevent memory leak Date: Thu, 14 Jan 2016 07:11:28 +0000 Message-Id: <1452755489-18736-4-git-send-email-lee.jones@linaro.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1452755489-18736-1-git-send-email-lee.jones@linaro.org> References: <1452755489-18736-1-git-send-email-lee.jones@linaro.org> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If we set the Signal twice or more, without using it as part of a message, memory will be re-allocated and the pointer over-written. Prevent this potential leak by only allocating memory when there isn't any already. Reported-by: Dan Carpenter Signed-off-by: Lee Jones --- drivers/mailbox/mailbox-test.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) -- 1.9.1 diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c index e370aa6..539d475 100644 --- a/drivers/mailbox/mailbox-test.c +++ b/drivers/mailbox/mailbox-test.c @@ -58,9 +58,12 @@ static ssize_t mbox_test_signal_write(struct file *filp, return -EINVAL; } - tdev->signal = kzalloc(MBOX_MAX_SIG_LEN, GFP_KERNEL); - if (!tdev->signal) - return -ENOMEM; + /* Only allocate memory if we need to */ + if (!tdev->signal) { + tdev->signal = kzalloc(MBOX_MAX_SIG_LEN, GFP_KERNEL); + if (!tdev->signal) + return -ENOMEM; + } if (copy_from_user(tdev->signal, userbuf, count)) { kfree(tdev->signal);