linux-kernel - RE: [PATCH] USB: gadget: f_mass_storage: fix in fsg_common

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 12 May 2010 15:36:11 +0530
From:	Viral Mehta <Viral.Mehta@...infotech.com>
To:	Michał Nazarewicz <m.nazarewicz@...sung.com>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>
CC:	Kyungmin Park <kyungmin.park@...sung.com>,
	Marek Szyprowski <m.szyprowski@...sung.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] USB: gadget: f_mass_storage: fix in fsg_common_init()
 error recovery

>> Apart from that, IMHO,
>> 2894         kfree(common->luns);
>> should crash in case if your error path is followed.
>>
>> common->luns is allocd
>> 2712         /* Create the LUNs, open their backing files, and register the
>> 2713          * LUN devices in sysfs. */
>> 2714         curlun = kzalloc(nluns * sizeof *curlun, GFP_KERNEL);
>> 2715         if (!curlun) {
>> 2716                 kfree(common);
>> 2717                 return ERR_PTR(-ENOMEM);
>> 2718         }

>Yes, that's why the submitted patch changes that to "rc = -ENOMEM;
>goto errer_release;".

I think you misread.
In fsg_common_release(), we are freeing common->luns.
2894         kfree(common->luns);

However, these gets allocd in fsg_common_init()
2712         /* Create the LUNs, open their backing files, and register the
2713          * LUN devices in sysfs. */
2714         curlun = kzalloc(nluns * sizeof *curlun, GFP_KERNEL);
2715         if (!curlun) {
2716                 kfree(common);
2717                 return ERR_PTR(-ENOMEM);
2718         }


Now, if this kzalloc at line 2714 failed
And if your patch is applied, you will follow error_release path which in turn will call kfree on a pointer whose allocation is failed.

And this is true for the HUNK#1 as well.

Getting ? So, i still think the patch I sent looks simple and correct.




--
Best regards,                                        _     _
| Humble Liege of Serenely Enlightened Majesty of  o' \,=./ `o
| Computer Science,  Michał "mina86" Nazarewicz       (o o)
+----[mina86*mina86.com]---[mina86*jabber.org]----ooO--(_)--Ooo--

______________________________________________________________________

This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system.

______________________________________________________________________
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/