| From a7bd5b38d561a49dd601a0331253b164efd814a8 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 29 Aug 2019 15:28:39 +0300 |
| Subject: staging: greybus: light: fix a couple double frees |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| [ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ] |
| |
| The problem is in gb_lights_request_handler(). If we get a request to |
| change the config then we release the light with gb_lights_light_release() |
| and re-allocated it. However, if the allocation fails part way through |
| then we call gb_lights_light_release() again. This can lead to a couple |
| different double frees where we haven't cleared out the original values: |
| |
| gb_lights_light_v4l2_unregister(light); |
| ... |
| kfree(light->channels); |
| kfree(light->name); |
| |
| I also made a small change to how we set "light->channels_count = 0;". |
| The original code handled this part fine and did not cause a use after |
| free but it was sort of complicated to read. |
| |
| Fixes: 2870b52bae4c ("greybus: lights: add lights implementation") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Acked-by: Rui Miguel Silva <rmfrfs@gmail.com> |
| Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/staging/greybus/light.c | 12 ++++++------ |
| 1 file changed, 6 insertions(+), 6 deletions(-) |
| |
| diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c |
| index 9f01427f35f91..1cb82cc28aa76 100644 |
| --- a/drivers/staging/greybus/light.c |
| +++ b/drivers/staging/greybus/light.c |
| @@ -1102,21 +1102,21 @@ static void gb_lights_channel_release(struct gb_channel *channel) |
| static void gb_lights_light_release(struct gb_light *light) |
| { |
| int i; |
| - int count; |
| |
| light->ready = false; |
| |
| - count = light->channels_count; |
| - |
| if (light->has_flash) |
| gb_lights_light_v4l2_unregister(light); |
| + light->has_flash = false; |
| |
| - for (i = 0; i < count; i++) { |
| + for (i = 0; i < light->channels_count; i++) |
| gb_lights_channel_release(&light->channels[i]); |
| - light->channels_count--; |
| - } |
| + light->channels_count = 0; |
| + |
| kfree(light->channels); |
| + light->channels = NULL; |
| kfree(light->name); |
| + light->name = NULL; |
| } |
| |
| static void gb_lights_release(struct gb_lights *glights) |
| -- |
| 2.20.1 |
| |