From: Dan Carpenter <dan.carpenter@linaro.org>
To: oe-kbuild@lists.linux.dev,
Stefan Binding <sbinding@opensource.cirrus.com>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
linux-kernel@vger.kernel.org, Takashi Iwai <tiwai@suse.de>
Subject: sound/pci/hda/cs35l41_hda.c:304 cs35l41_request_firmware_files() error: double free of '*wmfw_filename'
Date: Fri, 29 Sep 2023 10:13:04 +0300 [thread overview]
Message-ID: <4fe6a89d-372c-45f7-a7d2-7b8f376d983f@kadam.mountain> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 9ed22ae6be817d7a3f5c15ca22cbc9d3963b481d
commit: cd40dad2ca9196631dcd48e1b991244ab3940d83 ALSA: hda: cs35l41: Ensure firmware/tuning pairs are always loaded
config: x86_64-randconfig-161-20230929 (https://download.01.org/0day-ci/archive/20230929/202309291331.0JUUQnPT-lkp@intel.com/config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce: (https://download.01.org/0day-ci/archive/20230929/202309291331.0JUUQnPT-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202309291331.0JUUQnPT-lkp@intel.com/
smatch warnings:
sound/pci/hda/cs35l41_hda.c:304 cs35l41_request_firmware_files() error: double free of '*wmfw_filename'
vim +304 sound/pci/hda/cs35l41_hda.c
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 238 static int cs35l41_request_firmware_files(struct cs35l41_hda *cs35l41,
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 239 const struct firmware **wmfw_firmware,
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 240 char **wmfw_filename,
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 241 const struct firmware **coeff_firmware,
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 242 char **coeff_filename)
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 243 {
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 244 int ret;
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 245
cd40dad2ca9196 Stefan Binding 2023-02-13 246 if (cs35l41->speaker_id > -1) {
cd40dad2ca9196 Stefan Binding 2023-02-13 247 ret = cs35l41_request_firmware_files_spkid(cs35l41, wmfw_firmware, wmfw_filename,
63f4b99f0089a9 Stefan Binding 2022-06-30 248 coeff_firmware, coeff_filename);
cd40dad2ca9196 Stefan Binding 2023-02-13 249 goto out;
cd40dad2ca9196 Stefan Binding 2023-02-13 250
cd40dad2ca9196 Stefan Binding 2023-02-13 251 }
63f4b99f0089a9 Stefan Binding 2022-06-30 252
bb6eb621f522d1 Stefan Binding 2022-06-30 253 /* try cirrus/part-dspN-fwtype-sub<-ampname>.wmfw */
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 254 ret = cs35l41_request_firmware_file(cs35l41, wmfw_firmware, wmfw_filename,
bb6eb621f522d1 Stefan Binding 2022-06-30 255 CS35L41_FIRMWARE_ROOT, cs35l41->acpi_subsystem_id,
63f4b99f0089a9 Stefan Binding 2022-06-30 256 cs35l41->amp_name, -1, "wmfw");
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 257 if (!ret) {
bb6eb621f522d1 Stefan Binding 2022-06-30 258 /* try cirrus/part-dspN-fwtype-sub<-ampname>.bin */
cd40dad2ca9196 Stefan Binding 2023-02-13 259 ret = cs35l41_request_firmware_file(cs35l41, coeff_firmware, coeff_filename,
cd40dad2ca9196 Stefan Binding 2023-02-13 260 CS35L41_FIRMWARE_ROOT,
cd40dad2ca9196 Stefan Binding 2023-02-13 261 cs35l41->acpi_subsystem_id, cs35l41->amp_name,
cd40dad2ca9196 Stefan Binding 2023-02-13 262 -1, "bin");
cd40dad2ca9196 Stefan Binding 2023-02-13 263 goto out;
bb6eb621f522d1 Stefan Binding 2022-06-30 264 }
bb6eb621f522d1 Stefan Binding 2022-06-30 265
bb6eb621f522d1 Stefan Binding 2022-06-30 266 /* try cirrus/part-dspN-fwtype-sub.wmfw */
bb6eb621f522d1 Stefan Binding 2022-06-30 267 ret = cs35l41_request_firmware_file(cs35l41, wmfw_firmware, wmfw_filename,
bb6eb621f522d1 Stefan Binding 2022-06-30 268 CS35L41_FIRMWARE_ROOT, cs35l41->acpi_subsystem_id,
63f4b99f0089a9 Stefan Binding 2022-06-30 269 NULL, -1, "wmfw");
bb6eb621f522d1 Stefan Binding 2022-06-30 270 if (!ret) {
bb6eb621f522d1 Stefan Binding 2022-06-30 271 /* try cirrus/part-dspN-fwtype-sub<-ampname>.bin */
bb6eb621f522d1 Stefan Binding 2022-06-30 272 ret = cs35l41_request_firmware_file(cs35l41, coeff_firmware, coeff_filename,
bb6eb621f522d1 Stefan Binding 2022-06-30 273 CS35L41_FIRMWARE_ROOT,
bb6eb621f522d1 Stefan Binding 2022-06-30 274 cs35l41->acpi_subsystem_id,
63f4b99f0089a9 Stefan Binding 2022-06-30 275 cs35l41->amp_name, -1, "bin");
bb6eb621f522d1 Stefan Binding 2022-06-30 276 if (ret)
bb6eb621f522d1 Stefan Binding 2022-06-30 277 /* try cirrus/part-dspN-fwtype-sub.bin */
cd40dad2ca9196 Stefan Binding 2023-02-13 278 ret = cs35l41_request_firmware_file(cs35l41, coeff_firmware, coeff_filename,
bb6eb621f522d1 Stefan Binding 2022-06-30 279 CS35L41_FIRMWARE_ROOT,
cd40dad2ca9196 Stefan Binding 2023-02-13 280 cs35l41->acpi_subsystem_id, NULL, -1,
cd40dad2ca9196 Stefan Binding 2023-02-13 281 "bin");
bb6eb621f522d1 Stefan Binding 2022-06-30 282 }
bb6eb621f522d1 Stefan Binding 2022-06-30 283
cd40dad2ca9196 Stefan Binding 2023-02-13 284 out:
cd40dad2ca9196 Stefan Binding 2023-02-13 285 if (!ret)
cd40dad2ca9196 Stefan Binding 2023-02-13 286 return 0;
cd40dad2ca9196 Stefan Binding 2023-02-13 287
cd40dad2ca9196 Stefan Binding 2023-02-13 288 /* Handle fallback */
cd40dad2ca9196 Stefan Binding 2023-02-13 289 dev_warn(cs35l41->dev, "Falling back to default firmware.\n");
cd40dad2ca9196 Stefan Binding 2023-02-13 290
cd40dad2ca9196 Stefan Binding 2023-02-13 291 release_firmware(*wmfw_firmware);
cd40dad2ca9196 Stefan Binding 2023-02-13 292 kfree(*wmfw_filename);
Freed here.
cd40dad2ca9196 Stefan Binding 2023-02-13 293
bb6eb621f522d1 Stefan Binding 2022-06-30 294 /* fallback try cirrus/part-dspN-fwtype.wmfw */
bb6eb621f522d1 Stefan Binding 2022-06-30 295 ret = cs35l41_request_firmware_file(cs35l41, wmfw_firmware, wmfw_filename,
63f4b99f0089a9 Stefan Binding 2022-06-30 296 CS35L41_FIRMWARE_ROOT, NULL, NULL, -1, "wmfw");
Assume this fails.
cd40dad2ca9196 Stefan Binding 2023-02-13 297 if (!ret)
Better to flip this around:
if (ret)
return ret;
bb6eb621f522d1 Stefan Binding 2022-06-30 298 /* fallback try cirrus/part-dspN-fwtype.bin */
cd40dad2ca9196 Stefan Binding 2023-02-13 299 ret = cs35l41_request_firmware_file(cs35l41, coeff_firmware, coeff_filename,
63f4b99f0089a9 Stefan Binding 2022-06-30 300 CS35L41_FIRMWARE_ROOT, NULL, NULL, -1, "bin");
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 301
cd40dad2ca9196 Stefan Binding 2023-02-13 302 if (ret) {
cd40dad2ca9196 Stefan Binding 2023-02-13 303 release_firmware(*wmfw_firmware);
cd40dad2ca9196 Stefan Binding 2023-02-13 @304 kfree(*wmfw_filename);
The zero day bot doesn't have cross function analysis so the
kfree(*wmfw_filename); warning is a false positive, but the second
release_firmware() is a double free if the kasprintf() in
cs35l41_request_firmware_file() fails. You would have to get pretty
unlucky to hit this bug.
cd40dad2ca9196 Stefan Binding 2023-02-13 305 dev_warn(cs35l41->dev, "Unable to find firmware and tuning\n");
cd40dad2ca9196 Stefan Binding 2023-02-13 306 }
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 307 return ret;
2e81e1fffd53ba Vitaly Rodionov 2022-06-30 308 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2023-09-29 7:13 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4fe6a89d-372c-45f7-a7d2-7b8f376d983f@kadam.mountain \
--to=dan.carpenter@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oe-kbuild@lists.linux.dev \
--cc=sbinding@opensource.cirrus.com \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®