| Message ID | 20221207040049.1.I1864b6a7ee98824118b93677868d22d3750f439b@changeid (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | platform/chrome: cros_ec_typec: zero out stale pointers | expand |
Hi Victor, On Tue, Dec 6, 2022 at 8:02 PM Victor Ding <victording@chromium.org> wrote: > > `cros_typec_get_switch_handles` allocates several pointers when > obtaining four handles. These pointers are all freed if failing to > obtain any of the four handles; therefore, pointers in `port` becomes > stale. The stale pointers eventually cause use-after-free or double in > later code paths. > > This patch proposes Please use the imperative form [1] > to elimite these stale pointers by zeroing them out s/elimite/eliminate > right after they are freed. > > Signed-off-by: Victor Ding <victording@chromium.org> This should have a "Fixes" tag. Best regards, -Prashant [1] https://www.kernel.org/doc/html/latest/process/submitting-patches.html#describe-your-changes
Hi Prashant, Thank you for reviewing. I'll update accordingly in the next revision. On Wed, Dec 7, 2022 at 7:02 PM Prashant Malani <pmalani@chromium.org> wrote: > > Hi Victor, > > On Tue, Dec 6, 2022 at 8:02 PM Victor Ding <victording@chromium.org> wrote: > > > > `cros_typec_get_switch_handles` allocates several pointers when > > obtaining four handles. These pointers are all freed if failing to > > obtain any of the four handles; therefore, pointers in `port` becomes > > stale. The stale pointers eventually cause use-after-free or double in > > later code paths. > > > > This patch proposes > Please use the imperative form [1] > > > to elimite these stale pointers by zeroing them out > > s/elimite/eliminate > > > right after they are freed. > > > > Signed-off-by: Victor Ding <victording@chromium.org> > This should have a "Fixes" tag. > > Best regards, > > -Prashant > > [1] https://www.kernel.org/doc/html/latest/process/submitting-patches.html#describe-your-changes Best regards, Victor
diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c index 2a7ff14dc37e..59de4ce01fab 100644 --- a/drivers/platform/chrome/cros_ec_typec.c +++ b/drivers/platform/chrome/cros_ec_typec.c @@ -173,10 +173,13 @@ static int cros_typec_get_switch_handles(struct cros_typec_port *port, role_sw_err: typec_switch_put(port->ori_sw); + port->ori_sw = NULL; ori_sw_err: typec_retimer_put(port->retimer); + port->retimer = NULL; retimer_sw_err: typec_mux_put(port->mux); + port->mux = NULL; mux_err: return -ENODEV; }
`cros_typec_get_switch_handles` allocates several pointers when obtaining four handles. These pointers are all freed if failing to obtain any of the four handles; therefore, pointers in `port` becomes stale. The stale pointers eventually cause use-after-free or double in later code paths. This patch proposes to elimite these stale pointers by zeroing them out right after they are freed. Signed-off-by: Victor Ding <victording@chromium.org> --- drivers/platform/chrome/cros_ec_typec.c | 3 +++ 1 file changed, 3 insertions(+)