linux-kernel - Re: [Patch] fs/binfmt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080503143942.GE3986@hack>
Date:	Sat, 3 May 2008 22:39:43 +0800
From:	WANG Cong <xiyou.wangcong@...il.com>
To:	Pekka J Enberg <penberg@...helsinki.fi>
Cc:	WANG Cong <xiyou.wangcong@...il.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Eric Youngdale <ericy@...s.com>, viro@...iv.linux.org.uk,
	linux-fsdevel@...r.kernel.org, Andrew Morton <akpm@...l.org>
Subject: Re: [Patch] fs/binfmt_elf.c: fix a wrong free

On Sat, May 03, 2008 at 04:26:11PM +0300, Pekka J Enberg wrote:
>On Sat, 3 May 2008, WANG Cong wrote:
>> Fix a wrong free in fs/binfmt_elf.c::elf_core_dump().
>> 
>> Signed-off-by: WANG Cong <wangcong@...ux.org>
>> Cc: Alexander Viro <viro@...iv.linux.org.uk>
>> Cc: Eric Youngdale <ericy@...s.com>
>> 
>> ---
>>  fs/binfmt_elf.c |    2 +-
>>  1 files changed, 1 insertions(+), 1 deletions(-)
>> 
>> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
>> index b25707f..43254e3 100644
>> --- a/fs/binfmt_elf.c
>> +++ b/fs/binfmt_elf.c
>> @@ -2032,10 +2032,10 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
>>  
>>  end_coredump:
>>  	set_fs(fs);
>> +	free_note_info(&info);
>>  
>>  cleanup:
>>  	kfree(elf);
>> -	free_note_info(&info);
>>  	return has_dumped;
>>  }
>
>Looks like fill_note_info() requires that you call free_note_info() if it 
>fails; otherwise we'll leak memory. So perhaps something like the 
>following totally untested patch?
>

Hi, Pekka!

Thanks for your comments. Yes, it seems that fill_note_info() is ugly.
:-) How about the below one?

Signed-off-by: WANG Cong <wangcong@...ux.org>

---
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index f6d5a9d..357b503 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1900,7 +1900,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
 	/* alloc memory for large data structures: too large to be on stack */
 	elf = kmalloc(sizeof(*elf), GFP_KERNEL);
 	if (!elf)
-		goto cleanup;
+		goto ret;
 	
 	segs = current->mm->map_count;
 #ifdef ELF_CORE_EXTRA_PHDRS
@@ -2034,8 +2034,9 @@ end_coredump:
 	set_fs(fs);
 
 cleanup:
-	kfree(elf);
 	free_note_info(&info);
+	kfree(elf);
+ret:
 	return has_dumped;
 }
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/