From patchwork Wed Mar 23 14:43:42 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lee Jones X-Patchwork-Id: 64228 Delivered-To: patch@linaro.org Received: by 10.112.199.169 with SMTP id jl9csp74367lbc; Wed, 23 Mar 2016 07:46:15 -0700 (PDT) X-Received: by 10.98.17.78 with SMTP id z75mr4980457pfi.40.1458744375443; Wed, 23 Mar 2016 07:46:15 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id ue3si4821640pab.68.2016.03.23.07.46.14; Wed, 23 Mar 2016 07:46:15 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932208AbcCWOpz (ORCPT + 29 others); Wed, 23 Mar 2016 10:45:55 -0400 Received: from mail-wm0-f44.google.com ([74.125.82.44]:35439 "EHLO mail-wm0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755433AbcCWOpx (ORCPT ); Wed, 23 Mar 2016 10:45:53 -0400 Received: by mail-wm0-f44.google.com with SMTP id l68so199389291wml.0 for ; Wed, 23 Mar 2016 07:45:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Y3QvNOp0qmEzrg+tgcImsznOseUdD64FDPSrplh8dyQ=; b=eqPGpM+dc8cARo9HR68rG/6xQsS7BWYVZ979klgBUxHMzlEMruSYV3s0pMPHjkso7y Oyf+bnP9F0fEUKhVC5iMoemVxnnsR5i0sVn5c6PUOdkYlyiLQFHXRolvsoDT3xPMmsK+ 2V9vIvwGTxgIdSCcwhajCFH/Ubv8r04frfgAs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Y3QvNOp0qmEzrg+tgcImsznOseUdD64FDPSrplh8dyQ=; b=mPGyE9eERQA/d8s8707LG1q4KjjeiCNSBRMg3EJRg9rlFzee1rQlsivymMBfRFipxe 6sqlzCJ6FpQX7gaXSJsL+d8udgbvM39KCoxEj40UQRqBiGVw8vFqj4Dibo931m6LXcnQ SpLrDwHbAuWYMMu1Rv0wUZgH26FXEKYfzn4zESVPnA+oq78TYOI1npTs3JJXQucvila2 3InQtwyFsiYpjmWc9UOIBxAX7S6DTgDlnUakSd7wk1UuxMTtjBgWtBeb6/t2aD8thDg1 19bpXSbwftW9kt7kqx6iBYCO7y12RczL0jh9+3ptqeKXEZwoBGhzwYBR7G8zf/bPANpZ I53Q== X-Gm-Message-State: AD7BkJL70Gs9pkaWMA156KGxcnWWv0QFP1HnIax+PTgVeTSxT+WizFx1CpPKYWAX2zEota9S X-Received: by 10.194.71.177 with SMTP id w17mr4421296wju.36.1458744352213; Wed, 23 Mar 2016 07:45:52 -0700 (PDT) Received: from localhost.localdomain (host81-129-172-93.range81-129.btcentralplus.com. [81.129.172.93]) by smtp.gmail.com with ESMTPSA id 192sm3339980wmw.0.2016.03.23.07.45.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 23 Mar 2016 07:45:51 -0700 (PDT) From: Lee Jones To: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Cc: kernel@stlinux.com, maxime.coquelin@st.com, jassisinghbrar@gmail.com, dan.carpenter@oracle.com, Lee Jones Subject: [PATCH v2 4/5] mailbox: mailbox-test: Prevent memory leak Date: Wed, 23 Mar 2016 14:43:42 +0000 Message-Id: <1458744223-12164-5-git-send-email-lee.jones@linaro.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1458744223-12164-1-git-send-email-lee.jones@linaro.org> References: <1458744223-12164-1-git-send-email-lee.jones@linaro.org> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If we set the Signal twice or more, without using it as part of a message, memory will be re-allocated and the pointer over-written. Prevent this potential leak by only allocating memory when there isn't any already. Reported-by: Dan Carpenter Signed-off-by: Lee Jones --- drivers/mailbox/mailbox-test.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) -- 1.9.1 diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c index 5f4b439..58d0472 100644 --- a/drivers/mailbox/mailbox-test.c +++ b/drivers/mailbox/mailbox-test.c @@ -59,9 +59,12 @@ static ssize_t mbox_test_signal_write(struct file *filp, return -EINVAL; } - tdev->signal = kzalloc(MBOX_MAX_SIG_LEN, GFP_KERNEL); - if (!tdev->signal) - return -ENOMEM; + /* Only allocate memory if we need to */ + if (!tdev->signal) { + tdev->signal = kzalloc(MBOX_MAX_SIG_LEN, GFP_KERNEL); + if (!tdev->signal) + return -ENOMEM; + } if (copy_from_user(tdev->signal, userbuf, count)) { kfree(tdev->signal);