| Message ID | 20241001231147.3583649-1-tkjos@google.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 2985b1844f3f3447f2d938eff1ef6762592065a5 |
| Headers | show |
| Series | PCI: fix memory leak in reset_method_store() | expand |
On Tue, Oct 01, 2024 at 11:11:47PM +0000, Todd Kjos wrote: > In reset_method_store(), a string is allocated via kstrndup() > and assigned to the local "options". options is then used > in with strsep() to find spaces: > > while ((name = strsep(&options, " ")) != NULL) { > > If there are no remaining spaces, then options is set to NULL > by strsep(), so the subsequent kfree(options) doesn't free the > memory allocated via kstrndup(). > > Fix by using a separate tmp_options to iterate with > strsep() so options is preserved. > > Fixes: d88f521da3ef ("PCI: Allow userspace to query and set device reset mechanism") > Signed-off-by: Todd Kjos <tkjos@google.com> Applied to pci/misc for v6.13, thank you! > --- > drivers/pci/pci.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c > index 7d85c04fbba2..0e6562ff3dcf 100644 > --- a/drivers/pci/pci.c > +++ b/drivers/pci/pci.c > @@ -5244,7 +5244,7 @@ static ssize_t reset_method_store(struct device *dev, > const char *buf, size_t count) > { > struct pci_dev *pdev = to_pci_dev(dev); > - char *options, *name; > + char *options, *tmp_options, *name; > int m, n; > u8 reset_methods[PCI_NUM_RESET_METHODS] = { 0 }; > > @@ -5264,7 +5264,8 @@ static ssize_t reset_method_store(struct device *dev, > return -ENOMEM; > > n = 0; > - while ((name = strsep(&options, " ")) != NULL) { > + tmp_options = options; > + while ((name = strsep(&tmp_options, " ")) != NULL) { > if (sysfs_streq(name, "")) > continue; > > -- > 2.46.1.824.gd892dcdcdd-goog >
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 7d85c04fbba2..0e6562ff3dcf 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5244,7 +5244,7 @@ static ssize_t reset_method_store(struct device *dev, const char *buf, size_t count) { struct pci_dev *pdev = to_pci_dev(dev); - char *options, *name; + char *options, *tmp_options, *name; int m, n; u8 reset_methods[PCI_NUM_RESET_METHODS] = { 0 }; @@ -5264,7 +5264,8 @@ static ssize_t reset_method_store(struct device *dev, return -ENOMEM; n = 0; - while ((name = strsep(&options, " ")) != NULL) { + tmp_options = options; + while ((name = strsep(&tmp_options, " ")) != NULL) { if (sysfs_streq(name, "")) continue;
In reset_method_store(), a string is allocated via kstrndup() and assigned to the local "options". options is then used in with strsep() to find spaces: while ((name = strsep(&options, " ")) != NULL) { If there are no remaining spaces, then options is set to NULL by strsep(), so the subsequent kfree(options) doesn't free the memory allocated via kstrndup(). Fix by using a separate tmp_options to iterate with strsep() so options is preserved. Fixes: d88f521da3ef ("PCI: Allow userspace to query and set device reset mechanism") Signed-off-by: Todd Kjos <tkjos@google.com> --- drivers/pci/pci.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)