linux-kernel - RE: [PATCH -next] mei: fix krealloc() misuse in in mei_cl_irq_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 23 Apr 2013 04:29:09 +0000
From:	"Winkler, Tomas" <tomas.winkler@...el.com>
To:	Wei Yongjun <weiyj.lk@...il.com>,
	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC:	"yongjun_wei@...ndmicro.com.cn" <yongjun_wei@...ndmicro.com.cn>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH -next] mei: fix krealloc() misuse in in
 mei_cl_irq_read_msg()

 
> From: Wei Yongjun <yongjun_wei@...ndmicro.com.cn>
> 
> If krealloc() returns NULL, it doesn't free the original. So any code of the form
> 'foo = krealloc(foo, ...);' is almost certainly a bug.
> 
> Introduced by commit fcb136e1ac5774909e0d85189f721b8dfa800e0f(mei: fix
> reading large reposnes)
> 
> Signed-off-by: Wei Yongjun <yongjun_wei@...ndmicro.com.cn>
Thanks, strange that my checkpatch didn't shout on that. 
I don't like the unrelated reuse of the  buffer variable but the code looks correct so ACK.

Thanks
Tomas

> ---
>  drivers/misc/mei/interrupt.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c index
> 37a8c35..089c516 100644
> --- a/drivers/misc/mei/interrupt.c
> +++ b/drivers/misc/mei/interrupt.c
> @@ -148,16 +148,16 @@ static int mei_cl_irq_read_msg(struct mei_device
> *dev,
>  			dev_dbg(&dev->pdev->dev, "message overflow.
> size %d len %d idx %ld\n",
>  				cb->response_buffer.size,
>  				mei_hdr->length, cb->buf_idx);
> -			cb->response_buffer.data =
> -					krealloc(cb->response_buffer.data,
> -					mei_hdr->length + cb->buf_idx,
> -					GFP_KERNEL);
> +			buffer = krealloc(cb->response_buffer.data,
> +					  mei_hdr->length + cb->buf_idx,
> +					  GFP_KERNEL);
> 
> -			if (!cb->response_buffer.data) {
> +			if (!buffer) {
>  				dev_err(&dev->pdev->dev, "allocation
> failed.\n");
>  				list_del(&cb->list);
>  				return -ENOMEM;
>  			}
> +			cb->response_buffer.data = buffer;
>  			cb->response_buffer.size =
>  				mei_hdr->length + cb->buf_idx;
>  		}

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/