Commit fc9eec4d authored by Vadym Kochan's avatar Vadym Kochan Committed by Greg Kroah-Hartman
Browse files

nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell() 



Fix missing 'kfree_const(cell->name)' when call to
nvmem_cell_info_to_nvmem_cell() in several places:

     * after nvmem_cell_info_to_nvmem_cell() failed during
       nvmem_add_cells()

     * during nvmem_device_cell_{read,write} when cell->name is
       kstrdup'ed() without calling kfree_const() at the end, but
       really there is no reason to do that 'dup, because the cell
       instance is allocated on the stack for some short period to be
       read/write without exposing it to the caller.

So the new nvmem_cell_info_to_nvmem_cell_nodup() helper is introduced
which is used to convert cell_info -> cell without name duplication as
a lighweight version of nvmem_cell_info_to_nvmem_cell().

Fixes: e2a5402e ("nvmem: Add nvmem_device based consumer apis.")
Reviewed-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
Acked-by: default avatarSrinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: default avatarVadym Kochan <vadym.kochan@plvision.eu>
Link: https://lore.kernel.org/r/20200923204456.14032-1-vadym.kochan@plvision.eu


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 709ec3f7

drivers/nvmem/core.c

+24 −9
Original line number Diff line number Diff line
@@ -361,16 +361,14 @@ static void nvmem_cell_add(struct nvmem_cell *cell) 
	blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_ADD, cell);

}



static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,

static int nvmem_cell_info_to_nvmem_cell_nodup(struct nvmem_device *nvmem,

					const struct nvmem_cell_info *info,

					struct nvmem_cell *cell)

{

	cell->nvmem = nvmem;

	cell->offset = info->offset;

	cell->bytes = info->bytes;

	cell->name = kstrdup_const(info->name, GFP_KERNEL);

	if (!cell->name)

		return -ENOMEM;

	cell->name = info->name;



	cell->bit_offset = info->bit_offset;

	cell->nbits = info->nbits;
@@ -382,13 +380,30 @@ static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem, 
	if (!IS_ALIGNED(cell->offset, nvmem->stride)) {

		dev_err(&nvmem->dev,

			"cell %s unaligned to nvmem stride %d\n",

			cell->name, nvmem->stride);

			cell->name ?: "<unknown>", nvmem->stride);

		return -EINVAL;

	}



	return 0;

}



static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,

				const struct nvmem_cell_info *info,

				struct nvmem_cell *cell)

{

	int err;



	err = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, cell);

	if (err)

		return err;



	cell->name = kstrdup_const(info->name, GFP_KERNEL);

	if (!cell->name)

		return -ENOMEM;



	return 0;

}



/**

 * nvmem_add_cells() - Add cell information to an nvmem device

 *
@@ -1463,7 +1478,7 @@ ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem, 
	if (!nvmem)

		return -EINVAL;



	rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);

	rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);

	if (rc)

		return rc;
@@ -1493,7 +1508,7 @@ int nvmem_device_cell_write(struct nvmem_device *nvmem, 
	if (!nvmem)

		return -EINVAL;



	rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell);

	rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell);

	if (rc)

		return rc;

CRA Git | Maintained and supported by SUSTech CRA and CCSE