diff options
author | Justin M. Forbes <jforbes@fedoraproject.org> | 2019-12-02 09:14:44 -0600 |
---|---|---|
committer | Justin M. Forbes <jforbes@fedoraproject.org> | 2019-12-02 09:14:44 -0600 |
commit | fbd3f73ad4da4ae212c7eaee500e78d623b6a74b (patch) | |
tree | 617123502e11ad156d7a56147497689c6a63de28 /0001-ASoC-SOF-Fix-memory-leak-in-sof_dfsentry_write.patch | |
parent | bf6e2e5c451ec4c8cf99792c5174aed9fa65c6e1 (diff) | |
download | kernel-fbd3f73ad4da4ae212c7eaee500e78d623b6a74b.tar.gz kernel-fbd3f73ad4da4ae212c7eaee500e78d623b6a74b.tar.xz kernel-fbd3f73ad4da4ae212c7eaee500e78d623b6a74b.zip |
Fix CVE-2019-18808 CVE-2019-18809 CVE-2019-18811 CVE-2019-18812 CVE-2019-16232
Diffstat (limited to '0001-ASoC-SOF-Fix-memory-leak-in-sof_dfsentry_write.patch')
-rw-r--r-- | 0001-ASoC-SOF-Fix-memory-leak-in-sof_dfsentry_write.patch | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/0001-ASoC-SOF-Fix-memory-leak-in-sof_dfsentry_write.patch b/0001-ASoC-SOF-Fix-memory-leak-in-sof_dfsentry_write.patch new file mode 100644 index 000000000..587a2acd1 --- /dev/null +++ b/0001-ASoC-SOF-Fix-memory-leak-in-sof_dfsentry_write.patch @@ -0,0 +1,37 @@ +From c0a333d842ef67ac04adc72ff79dc1ccc3dca4ed Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost <navid.emamdoost@gmail.com> +Date: Sun, 27 Oct 2019 14:48:47 -0500 +Subject: [PATCH] ASoC: SOF: Fix memory leak in sof_dfsentry_write + +In the implementation of sof_dfsentry_write() memory allocated for +string is leaked in case of an error. Go to error handling path if the +d_name.name is not valid. + +Fixes: 091c12e1f50c ("ASoC: SOF: debug: add new debugfs entries for IPC flood test") +Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> +Link: https://lore.kernel.org/r/20191027194856.4056-1-navid.emamdoost@gmail.com +Signed-off-by: Mark Brown <broonie@kernel.org> +--- + sound/soc/sof/debug.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/debug.c b/sound/soc/sof/debug.c +index 54cd431faab7..5529e8eeca46 100644 +--- a/sound/soc/sof/debug.c ++++ b/sound/soc/sof/debug.c +@@ -152,8 +152,10 @@ static ssize_t sof_dfsentry_write(struct file *file, const char __user *buffer, + * in the debugfs entry. + */ + if (strcmp(dfse->dfsentry->d_name.name, "ipc_flood_count") && +- strcmp(dfse->dfsentry->d_name.name, "ipc_flood_duration_ms")) +- return -EINVAL; ++ strcmp(dfse->dfsentry->d_name.name, "ipc_flood_duration_ms")) { ++ ret = -EINVAL; ++ goto out; ++ } + + if (!strcmp(dfse->dfsentry->d_name.name, "ipc_flood_duration_ms")) + flood_duration_test = true; +-- +2.23.0 + |