efi: fix error handling in add_sysfs_runtime_map_entry()
PATCH 1/1 efi: fix error handling in add_sysfs_runtime_map_entry()
I spotted two (difficult to hit) bugs while reviewing this.
1) There is a double free bug because we unregister "map_kset" in add_sysfs_runtime_map_entry() and also efi_runtime_map_init().
2) If we fail to allocate "entry" then we should return ERR_PTR(-ENOMEM) instead of NULL.
drivers/firmware/efi/runtime-map.c +3 -3
@@ -120,7 +120,8 @@ add_sysfs_runtime_map_entry(struct kobject *kobj, int nr) entry =kzalloc (sizeof (*entry),GFP_KERNEL );if (!entry) {kset_unregister (map_kset); -return entry; + map_kset =NULL ; +return ERR_PTR (-ENOMEM ); } memcpy(&entry->md, efi_runtime_map + nr * efi_memdesc_size,
@@ -132,6 +133,7 @@ add_sysfs_runtime_map_entry(struct kobject *kobj, int nr)if (ret) {kobject_put (&entry->kobj);kset_unregister (map_kset); + map_kset =NULL ;return ERR_PTR (ret); }
@@ -195,8 +197,6 @@ out_add_entry: entry = *(map_entries + j);kobject_put (&entry->kobj); } -if (map_kset) -kset_unregister (map_kset); out:return ret; }
Matt Fleming
AppliedQuoted 8 lines · Dan Carpenter
I spotted two (difficult to hit) bugs while reviewing this.
1) There is a double free bug because we unregister "
map_kset" inadd_sysfs_runtime_map_entry()and alsoefi_runtime_map_init().
2) If we fail to allocate "entry" then we should returnERR_PTR(-ENOMEM)instead of NULL.Signed-off-by Dan Carpenter <[email protected]>
Thanks applied.
(Leaving the patch intact for Dave's benefit)
Quoted 35 lines
drivers/firmware/efi/runtime-map.c +3
-4@@ -120,7 +120,8 @@ add_sysfs_runtime_map_entry(struct kobject *kobj, int nr) entry =kzalloc (sizeof (*entry),GFP_KERNEL );if (!entry) {kset_unregister (map_kset); -return entry; + map_kset =NULL ; +return ERR_PTR (-ENOMEM ); } memcpy(&entry->md, efi_runtime_map + nr * efi_memdesc_size,@@ -132,6 +133,7 @@ add_sysfs_runtime_map_entry(struct kobject *kobj, int nr)if (ret) {kobject_put (&entry->kobj);kset_unregister (map_kset); + map_kset =NULL ;return ERR_PTR (ret); }@@ -195,8 +197,6 @@ out_add_entry: entry = *(map_entries + j);kobject_put (&entry->kobj); } -if (map_kset) -kset_unregister (map_kset); out:return ret; } --To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Signature · 1 line
Matt Fleming, Intel Open Source Technology Center