linux-kernel - Re: [PATCH 4/4] ALSA: emu10k1: Cocci spatch "alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Sep 2017 22:39:13 +0200
From:   Takashi Iwai <tiwai@...e.de>
To:     "Al Viro" <viro@...IV.linux.org.uk>
Cc:     "Thomas Meyer" <thomas@...3r.de>, <alsa-devel@...a-project.org>,
        <perex@...ex.cz>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 4/4] ALSA: emu10k1: Cocci spatch "alloc_cast"

On Thu, 21 Sep 2017 19:39:15 +0200,
Al Viro wrote:
> 
> On Thu, Sep 21, 2017 at 08:33:46AM +0200, Thomas Meyer wrote:
> > Remove casting the values returned by memory allocation functions like
> > kmalloc, kzalloc, kmem_cache_alloc, kmem_cache_zalloc etc."
> > Found by coccinelle spatch "api/alloc/alloc_cast.cocci"
> > 
> > Signed-off-by: Thomas Meyer <thomas@...3r.de>
> > ---
> > 
> > diff -u -p a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
> > --- a/sound/pci/emu10k1/emufx.c
> > +++ b/sound/pci/emu10k1/emufx.c
> > @@ -1218,7 +1218,7 @@ static int _snd_emu10k1_audigy_init_efx(
> >  	if (!icode)
> >  		return err;
> >  
> > -	icode->gpr_map = (u_int32_t __user *) kcalloc(512 + 256 + 256 + 2 * 1024,
> > +	icode->gpr_map = kcalloc(512 + 256 + 256 + 2 * 1024,
> >  						      sizeof(u_int32_t), GFP_KERNEL);
> 
> 	And _this_ is a wonderful example of the reasons why that kind of
> patches is bloody bad.  The code you've caught is very obviously smelly -
> kcalloc() does *NOT* return a userland pointer.  You are whitewashing it;
> a major "something weird is going on here" sign is gone (something weird
> in that case is hopefully a set_fs(KERNEL_DS) somewhere nearby, and it
> is asking for careful review).

Right, the code touched by the patch is a really tricky one.  It uses
the same struct that contains __user pointer which is supposed to be
filled by ioctl, but in this case, the function allocates the kernel
buffer and passes it with a special flag mentioning it being a kernel
buffer later.


thanks,

Takashi