[4.19,111/264] nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell()

From: Vadym Kochan <vadym.kochan@plvision.eu>

[ Upstream commit fc9eec4d643597cf4cb2fef17d48110e677610da ]

Fix missing 'kfree_const(cell->name)' when call to
nvmem_cell_info_to_nvmem_cell() in several places:

     * after nvmem_cell_info_to_nvmem_cell() failed during
       nvmem_add_cells()

     * during nvmem_device_cell_{read,write} when cell->name is
       kstrdup'ed() without calling kfree_const() at the end, but
       really there is no reason to do that 'dup, because the cell
       instance is allocated on the stack for some short period to be
       read/write without exposing it to the caller.

So the new nvmem_cell_info_to_nvmem_cell_nodup() helper is introduced
which is used to convert cell_info -> cell without name duplication as
a lighweight version of nvmem_cell_info_to_nvmem_cell().

Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Vadym Kochan <vadym.kochan@plvision.eu>
Link: https://lore.kernel.org/r/20200923204456.14032-1-vadym.kochan@plvision.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvmem/core.c | 29 +++++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

Hi!

> From: Vadym Kochan <vadym.kochan@plvision.eu>
> 
> [ Upstream commit fc9eec4d643597cf4cb2fef17d48110e677610da ]
> 
> Fix missing 'kfree_const(cell->name)' when call to
> nvmem_cell_info_to_nvmem_cell() in several places:
> 
>      * after nvmem_cell_info_to_nvmem_cell() failed during
>        nvmem_add_cells()
> 
>      * during nvmem_device_cell_{read,write} when cell->name is
>        kstrdup'ed() without calling kfree_const() at the end, but
>        really there is no reason to do that 'dup, because the cell
>        instance is allocated on the stack for some short period to be
>        read/write without exposing it to the caller.
> 
> So the new nvmem_cell_info_to_nvmem_cell_nodup() helper is introduced
> which is used to convert cell_info -> cell without name duplication as
> a lighweight version of nvmem_cell_info_to_nvmem_cell().
> 
> Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")

There's something very wrong here.

> index 30c040786fde2..54204d550fc22 100644
> --- a/drivers/nvmem/core.c
> +++ b/drivers/nvmem/core.c
> @@ -326,9 +326,9 @@ static void nvmem_cell_add(struct nvmem_cell *cell)
>  	mutex_unlock(&nvmem_cells_mutex);
>  }
>  
> -static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> -				   const struct nvmem_cell_info *info,
> -				   struct nvmem_cell *cell)
> +static int nvmem_cell_info_to_nvmem_cell_nodup(struct nvmem_device *nvmem,
> +					const struct nvmem_cell_info *info,
> +					struct nvmem_cell *cell)
>  {
>  	cell->nvmem = nvmem;
>  	cell->offset = info->offset;
> @@ -345,13 +345,30 @@ static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
>  	if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
>  		dev_err(&nvmem->dev,
>  			"cell %s unaligned to nvmem stride %d\n",
> -			cell->name, nvmem->stride);
> +			cell->name ?: "<unknown>", nvmem->stride);
>  		return -EINVAL;
>  	}
>  
>  	return 0;
>  }

We rename call from .._cell to .._cell_nodup, but it did not have the
kstrdup_const() in the first place!

> +static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
> +				const struct nvmem_cell_info *info,
> +				struct nvmem_cell *cell)
> +{
> +	int err;
> +
> +	err = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, cell);
> +	if (err)
> +		return err;
> +
> +	cell->name = kstrdup_const(info->name, GFP_KERNEL);
> +	if (!cell->name)
> +		return -ENOMEM;
> +
> +	return 0;
> +}

So now we introduce an allocation, but we don't have a place to free
it. In mainline, it is freed in nvmem_cell_drop(), but 4.19 does not
have a free there.

Best regards,
								Pavel

On Wed, Oct 28, 2020 at 09:12:34PM +0100, Pavel Machek wrote:
>Hi!
>
>> From: Vadym Kochan <vadym.kochan@plvision.eu>
>>
>> [ Upstream commit fc9eec4d643597cf4cb2fef17d48110e677610da ]
>>
>> Fix missing 'kfree_const(cell->name)' when call to
>> nvmem_cell_info_to_nvmem_cell() in several places:
>>
>>      * after nvmem_cell_info_to_nvmem_cell() failed during
>>        nvmem_add_cells()
>>
>>      * during nvmem_device_cell_{read,write} when cell->name is
>>        kstrdup'ed() without calling kfree_const() at the end, but
>>        really there is no reason to do that 'dup, because the cell
>>        instance is allocated on the stack for some short period to be
>>        read/write without exposing it to the caller.
>>
>> So the new nvmem_cell_info_to_nvmem_cell_nodup() helper is introduced
>> which is used to convert cell_info -> cell without name duplication as
>> a lighweight version of nvmem_cell_info_to_nvmem_cell().
>>
>> Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.")
>
>There's something very wrong here.

Right, looks like it actually fixes 16bb7abc4a6b ("nvmem: core: fix
memory abort in cleanup path"). I'll just drop this commit.