Skip to contentSkip to conversation

Fix dereferencing freed memory 'fw'

PATCH In review Dipendra Khadka 2 participants 4 messages Sep 22, 2024 – Sep 23, 2024

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 Fix dereferencing freed memory 'fw'

smatch reported dereferencing freed memory as below:
'''
drivers/usb/typec/tipd/core.c:1196 tps6598x_apply_patch() error: dereferencing freed memory 'fw' '''

Invoking release_firware(fw) just after checking ret.

---
 drivers/usb/typec/tipd/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/tipd/core.c +1 -1
index ea768b19a7f1..eb5596e3406a 100644
@@ -1191,11 +1191,11 @@ static int tps6598x_apply_patch(struct tps6598x *tps)
 	dev_info(tps->dev, "Firmware update succeeded\n");
 
 release_fw:
-	release_firmware(fw);
 	if (ret) {
 		dev_err(tps->dev, "Failed to write patch %s of %zu bytes\n",
 			firmware_name, fw->size);
 	}
+	release_firmware(fw);
 
 	return ret;
 };
Signature · 1 line
2.43.0
maintainer
#1 lore raw

Hi Dipendra,

Thanks for the patch. You forgot the susbsytem and driver from your subject line:
https://docs.kernel.org/process/submitting-patches.html#the-canonical-patch-format

Quoted 8 lines · Dipendra Khadka

smatch reported dereferencing freed memory as below:
'''
drivers/usb/typec/tipd/core.c:1196 tps6598x_apply_patch() error: dereferencing freed memory 'fw' '''

Invoking release_firware(fw) just after checking ret.

This is a use-after-free case, so please add the Fixes tag:

Fixes 916b8e5fa73d ("usb: typec: tipd: add error log to provide firmware name and size")
Quoted 23 lines
---
 drivers/usb/typec/tipd/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/tipd/core.c +1 -1
index ea768b19a7f1..eb5596e3406a 100644
@@ -1191,11 +1191,11 @@ static int tps6598x_apply_patch(struct tps6598x *tps)
 	dev_info(tps->dev, "Firmware update succeeded\n");
 
 release_fw:
-	release_firmware(fw);
 	if (ret) {
 		dev_err(tps->dev, "Failed to write patch %s of %zu bytes\n",
 			firmware_name, fw->size);
 	}
+	release_firmware(fw);
 
 	return ret;
 };
Signature · 1 line
2.43.0

thanks,

Signature · 1 line
heikki
maintainer
#2 lore raw
In reply to Dipendra Khadka
Quoted 4 lines · Dipendra Khadka

smatch reported dereferencing freed memory as below:
'''
drivers/usb/typec/tipd/core.c:1196 tps6598x_apply_patch() error: dereferencing freed memory 'fw' '''

This is only my opinion, but I don't like those '''single triple quotes''' in commit messages - they are just confusing. You don't need to use any kind of quotation marks in cases like this IMO.

thanks,

Signature · 1 line
heikki
#3 lore raw

Hi Heikki,

Quoted 11 lines · Heikki Krogerus
Quoted 4 lines · Dipendra Khadka

smatch reported dereferencing freed memory as below:
'''
drivers/usb/typec/tipd/core.c:1196 tps6598x_apply_patch() error: dereferencing freed memory 'fw' '''

This is only my opinion, but I don't like those '''single triple quotes''' in commit messages - they are just confusing. You don't need to use any kind of quotation marks in cases like this IMO.

Thanks for the feedback. I will send v2.

Quoted 4 lines

thanks,

--
heikki

Best Regards,
Dipendra Khadka