Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1480139

[PATCH 21/29] fs/efivarfs: Fix double kfree() in error path

Show all headers | View raw

Julia reported that we may double free 'name' in efivarfs_callback(),
and that this bug was introduced by commit 0d22f33bc37c ("efi: Don't
use spinlocks for efi vars").

Move one of the kfree()s until after the point at which we know we are
definitely on the success path.

Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Sylvain Chouleur <sylvain.chouleur@gmail.com>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
---
 fs/efivarfs/super.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index 01e3d6e53944..d7a7c53803c1 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -157,14 +157,14 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
 		goto fail_inode;
 	}
 
-	/* copied by the above to local storage in the dentry. */
-	kfree(name);
-
 	efivar_entry_size(entry, &size);
 	err = efivar_entry_add(entry, &efivarfs_list);
 	if (err)
 		goto fail_inode;
 
+	/* copied by the above to local storage in the dentry. */
+	kfree(name);
+
 	inode_lock(inode);
 	inode->i_private = entry;
 	i_size_write(inode, size + sizeof(entry->var.Attributes));
-- 
2.9.3

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[GIT PULL 00/29] EFI changes for v4.9 Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 20/29] x86/efi: Map in physical addresses in efi_map_region_fixed Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 27/29] x86/efi: Use kmalloc_array() in efi_call_phys_prolog() Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 04/29] efi: Add efi_memmap_init_late() for permanent EFI memmap Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 12/29] efi/esrt: Use memremap not ioremap to access ESRT table in memory Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 25/29] efi: Add efi_test driver for exporting UEFI runtime service interfaces Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 23/29] efi/arm64: Add debugfs node to dump UEFI runtime page tables Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 08/29] efi: Allow drivers to reserve boot services forever Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 22/29] x86/efi: Remove unused find_bits() function Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 10/29] efi/esrt: Use efi_mem_reserve() and avoid a kmalloc() Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 16/29] efi: Replace runtime services spinlock with semaphore Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 28/29] x86/efi: Optimize away setup_gop32/64 if unused Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 17/29] x86/efi: Initialize status to ensure garbage is not returned on small size Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 18/29] firmware-gsmi: Delete an unnecessary check before the function call "dma_pool_destroy" Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  [PATCH 21/29] fs/efivarfs: Fix double kfree() in error path Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-09 17:30 +0200
  Re: [GIT PULL 00/29] EFI changes for v4.9 Matt Fleming <matt@codeblueprint.co.uk> - 2016-09-12 13:00 +0200
    Re: [GIT PULL 00/29] EFI changes for v4.9 Ingo Molnar <mingo@kernel.org> - 2016-09-12 13:50 +0200
  Re: [GIT PULL 00/29] EFI changes for v4.9 Ingo Molnar <mingo@kernel.org> - 2016-09-13 20:40 +0200

csiph-web