linux-hardening - Re: Coverity: elf_create_prefix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20221108211045.hba5t63xmo3wuej7@treble>
Date:   Tue, 8 Nov 2022 13:10:45 -0800
From:   Josh Poimboeuf <jpoimboe@...nel.org>
To:     coverity-bot <keescook@...omium.org>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Miroslav Benes <mbenes@...e.cz>, linux-kernel@...r.kernel.org,
        Mikulas Patocka <mpatocka@...hat.com>,
        Borislav Petkov <bp@...e.de>, Yujie Liu <yujie.liu@...el.com>,
        "Gustavo A. R. Silva" <gustavo@...eddedor.com>,
        linux-next@...r.kernel.org, linux-hardening@...r.kernel.org
Subject: Re: Coverity: elf_create_prefix_symbol(): Resource leaks

On Fri, Nov 04, 2022 at 12:32:38PM -0700, coverity-bot wrote:
> Hello!
> 
> This is an experimental semi-automated report about issues detected by
> Coverity from a scan of next-20221104 as part of the linux-next scan project:
> https://scan.coverity.com/projects/linux-next-weekly-scan
> 
> You're getting this email because you were associated with the identified
> lines of code (noted below) that were touched by commits:
> 
>   Tue Nov 1 13:44:09 2022 +0100
>     9f2899fe36a6 ("objtool: Add option to generate prefix symbols")
> 
> Coverity reported the following:
> 
> *** CID 1527141:  Resource leaks  (RESOURCE_LEAK)
> tools/objtool/elf.c:833 in elf_create_prefix_symbol()
> 827     	struct symbol *sym = calloc(1, sizeof(*sym));
> 828     	size_t namelen = strlen(orig->name) + sizeof("__pfx_");
> 829     	char *name = malloc(namelen);
> 830
> 831     	if (!sym || !name) {
> 832     		perror("malloc");
> vvv     CID 1527141:  Resource leaks  (RESOURCE_LEAK)
> vvv     Variable "sym" going out of scope leaks the storage it points to.
> 833     		return NULL;
> 834     	}
> 835
> 836     	snprintf(name, namelen, "__pfx_%s", orig->name);
> 837
> 838     	sym->name = name;
> 
> If this is a false positive, please let us know so we can mark it as
> such, or teach the Coverity rules to be smarter. If not, please make
> sure fixes get into linux-next. :) For patches fixing this, please
> include these lines (but double-check the "Fixes" first):
> 
> Reported-by: coverity-bot <keescook+coverity-bot@...omium.org>
> Addresses-Coverity-ID: 1527141 ("Resource leaks")
> Fixes: 9f2899fe36a6 ("objtool: Add option to generate prefix symbols")

Please disable resource leak checking in objtool.  It's a short-lived
userspace tool for which we generally don't care about memory leaks.

-- 
Josh