On Tue, Sep 1, 2020 at 4:02 AM Vinod Koul <vkoul@xxxxxxxxxx> wrote:
>
> Hello Tom,
>
> On 29-08-20, 08:35, trix@xxxxxxxxxx wrote:
> > From: Tom Rix <trix@xxxxxxxxxx>
> >
> > clang static analysis flags this problem
> >
> > stream.c:844:9: warning: Use of memory after
> > it is freed
> > kfree(bus->defer_msg.msg->buf);
> > ^~~~~~~~~~~~~~~~~~~~~~~
> >
> > This happens in an error handler cleaning up memory
> > allocated for elements in a list.
> >
> > list_for_each_entry(m_rt, &stream->master_list, stream_node) {
> > bus = m_rt->bus;
> >
> > kfree(bus->defer_msg.msg->buf);
> > kfree(bus->defer_msg.msg);
> > }
> >
> > And is triggered when the call to sdw_bank_switch() fails.
> > There are a two problems.
> >
> > First, when sdw_bank_switch() fails, though it frees memory it
> > does not clear bus's reference 'defer_msg.msg' to that memory.
> >
> > The second problem is the freeing msg->buf. In some cases
> > msg will be NULL so this will dereference a null pointer.
> > Need to check before freeing.
>
> The change looks good to me, but the title of patch should be revised.
>
> The patch subject should describe the patch, in this case is setting
> pointer to null on cleanup, so an appropriate subject may be"
> "[PATCH]: soundwire: set defer_msg to null".
>
> Please revise subject line and update including the ack/reviews
> received
That's fair, I think
soundwire: fix double free of dangling pointer
would be most precise.
--
Thanks,
~Nick Desaulniers
