No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Tom Rix 3c660aa473 crypto: qat - fix double free in qat_uclo_create_batch_init_list
commit c06c76602e03bde24ee69a2022a829127e504202 upstream.

clang static analysis flags this error

qat_uclo.c:297:3: warning: Attempt to free released memory
  [unix.Malloc]
                kfree(*init_tab_base);
                ^~~~~~~~~~~~~~~~~~~~~

When input *init_tab_base is null, the function allocates memory for
the head of the list.  When there is problem allocating other list
elements the list is unwound and freed.  Then a check is made if the
list head was allocated and is also freed.

Keeping track of the what may need to be freed is the variable 'tail_old'.
The unwinding/freeing block is

	while (tail_old) {
		mem_init = tail_old->next;
		kfree(tail_old);
		tail_old = mem_init;
	}

The problem is that the first element of tail_old is also what was
allocated for the list head

		init_header = kzalloc(sizeof(*init_header), GFP_KERNEL);
		...
		*init_tab_base = init_header;
		flag = 1;
	}
	tail_old = init_header;

So *init_tab_base/init_header are freed twice.

There is another problem.
When the input *init_tab_base is non null the tail_old is calculated by
traveling down the list to first non null entry.

	tail_old = init_header;
	while (tail_old->next)
		tail_old = tail_old->next;

When the unwinding free happens, the last entry of the input list will
be freed.

So the freeing needs a general changed.
If locally allocated the first element of tail_old is freed, else it
is skipped.  As a bit of cleanup, reset *init_tab_base if it came in
as null.

Fixes: b4b7e67c91 ("crypto: qat - Intel(R) QAT ucode part of fw loader")
Cc: <stable@vger.kernel.org>
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-19 08:16:27 +02:00
arch irqdomain/treewide: Free firmware node after domain removal 2020-08-19 08:16:27 +02:00
block iocost: Fix check condition of iocg abs_vdebt 2020-08-19 08:15:58 +02:00
certs
crypto
Documentation iio: improve IIO_CONCENTRATION channel type description 2020-08-19 08:16:07 +02:00
drivers crypto: qat - fix double free in qat_uclo_create_batch_init_list 2020-08-19 08:16:27 +02:00
fs pstore: Fix linking when crypto API disabled 2020-08-19 08:16:27 +02:00
include tpm: Unify the mismatching TPM space buffer sizes 2020-08-19 08:16:27 +02:00
init
ipc
kernel seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID 2020-08-19 08:15:58 +02:00
lib kobject: Avoid premature parent object freeing in kobject_cleanup() 2020-08-19 08:16:11 +02:00
LICENSES
mm mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls 2020-08-19 08:16:02 +02:00
net net: initialize fastreuse on inet_inherit_port 2020-08-19 08:16:23 +02:00
samples bpf: Fix fds_example SIGSEGV error 2020-08-19 08:16:03 +02:00
scripts recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64. 2020-08-19 08:15:57 +02:00
security Smack: prevent underflow in smk_set_cipso() 2020-08-19 08:16:16 +02:00
sound ALSA: usb-audio: add quirk for Pioneer DDJ-RB 2020-08-19 08:16:27 +02:00
tools tools, bpftool: Fix wrong return value in do_dump() 2020-08-19 08:16:19 +02:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.