linux-kernel - Re: + zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 9 Jun 2015 11:17:06 +0900
From:	Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>
To:	akpm@...ux-foundation.org
Cc:	sergey.senozhatsky@...il.com, minchan@...nel.org,
	mm-commits@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: +
 zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache.patch added
 to -mm tree

On (06/08/15 13:55), akpm@...ux-foundation.org wrote:
> ------------------------------------------------------
> From: Sergey Senozhatsky <sergey.senozhatsky@...il.com>
> Subject: zsmalloc: fix a null pointer dereference in destroy_handle_cache()
> 
> If zs_create_pool()->create_handle_cache()->kmem_cache_create() fails,
> zs_create_pool()->destroy_handle_cache() will dereference the NULL
> pool->handle_cachep.
> 
> Modify destroy_handle_cache() to avoid this.
> 

Thank you, that's a nicer commit message.

A minor correction, zs_create_pool() can cause NULL pool->handle_cachep
from two places:
-- failed `zs_create_pool()->  pool->name = kstrdup(...)'
-- failed `zs_create_pool()->create_handle_cache()->kmem_cache_create()'



How about the following version:
---
If zs_create_pool()->create_handle_cache()->kmem_cache_create() or
pool->name allocation fails, zs_create_pool()->destroy_handle_cache()
will dereference the NULL pool->handle_cachep.

Modify destroy_handle_cache() to avoid this.

---

	-ss

> Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@...il.com>
> Cc: Minchan Kim <minchan@...nel.org>
> Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
> ---
> 
>  mm/zsmalloc.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff -puN mm/zsmalloc.c~zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache mm/zsmalloc.c
> --- a/mm/zsmalloc.c~zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache
> +++ a/mm/zsmalloc.c
> @@ -289,7 +289,8 @@ static int create_handle_cache(struct zs
>  
>  static void destroy_handle_cache(struct zs_pool *pool)
>  {
> -	kmem_cache_destroy(pool->handle_cachep);
> +	if (pool->handle_cachep)
> +		kmem_cache_destroy(pool->handle_cachep);
>  }
>  
>  static unsigned long alloc_handle(struct zs_pool *pool)
> _
> 
> Patches currently in -mm which might be from sergey.senozhatsky@...il.com are
> 
> zram-clear-disk-io-accounting-when-reset-zram-device.patch
> zsmalloc-fix-a-null-pointer-dereference-in-destroy_handle_cache.patch
> zram-add-compact-sysfs-entry-to-documentation.patch
> zram-cosmetic-zram_attr_ro-code-formatting-tweak.patch
> zram-use-idr-instead-of-zram_devices-array.patch
> zram-reorganize-code-layout.patch
> zram-remove-max_num_devices-limitation.patch
> zram-report-every-added-and-removed-device.patch
> zram-trivial-correct-flag-operations-comment.patch
> zram-return-zram-device_id-from-zram_add.patch
> zram-close-race-by-open-overriding.patch
> zram-add-dynamic-device-add-remove-functionality.patch
> zram-cosmetic-zram_bvec_write-cleanup.patch
> zram-cut-trailing-newline-in-algorithm-name.patch
> zram-check-comp-algorithm-availability-earlier.patch
> zram-check-comp-algorithm-availability-earlier-v2.patch
> linux-next.patch
> 
> --
> To unsubscribe from this list: send the line "unsubscribe mm-commits" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/