linux-kernel - Re: [PATCH 1/3] uml: drivers/net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1310130044.26209.3.camel@vivanov>
Date:	Fri, 08 Jul 2011 16:00:44 +0300
From:	Vitaliy Ivanov <vitalivanov@...il.com>
To:	Richard Weinberger <richard@....at>
Cc:	Jeff Dike <jdike@...toit.com>,
	user-mode-linux-devel@...ts.sourceforge.net,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/3] uml: drivers/net_user.c memory leak fix


> > > This control logic is a bit strange.
> > > When change_tramp() fails we should not printk() the output variable.
> > > 
> > > if (pid < 0){
> > >  free(output);
> > >  return;
> > > }
> > > 
> > > Would be much cleaner.
> > 
> > I just didn't want to clone this free-return stuff. So, what you
> > proposing is like this:
> > ------------
> > ...
> >         output = uml_kmalloc(output_len, UM_GFP_KERNEL);
> >         if (output == NULL)
> >                 printk(UM_KERN_ERR "change : failed to allocate output "
> >                        "buffer\n");
> > 
> >         pid = change_tramp(argv, output, output_len);
> >         if (pid < 0) {
> >                 free(output);               <---------- I'm not sure but 'output' can be NULL here.
> >                 return;
> >         }
> > 
> >         if (output != NULL) {
> >                 printk("%s", output);
> >                 kfree(output);
> >         }
> > }
> > ------------
> > 
> > I was trying to print 'output' only in case change_tramp is
> > successful. That's the old logic. And at the same time perform free
> > only in case output is not NULL.
> 
> Why?
> Freeing a NULL pointer is perfectly fine.

I should agree that something that you propose has better readability.

So, here is updated patch.

Thanks
---
>>From b0c5ca0336cc94b2fda251e0da7918394e59c5cd Mon Sep 17 00:00:00 2001
From: Vitaliy Ivanov <vitalivanov@...il.com>
Date: Fri, 8 Jul 2011 14:54:29 +0300
Subject: [PATCH] uml: drivers/net_user.c memory leak fix

Perform memory cleanup on exit.
On receiving invalid 'pid' we still should clean 'output' variable.

Signed-off-by: Vitaliy Ivanov <vitalivanov@...il.com>
Signed-off-by: Richard Weinberger <richard@....at>
---
 arch/um/drivers/net_user.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/arch/um/drivers/net_user.c b/arch/um/drivers/net_user.c
index 9415dd9..5201188 100644
--- a/arch/um/drivers/net_user.c
+++ b/arch/um/drivers/net_user.c
@@ -228,7 +228,10 @@ static void change(char *dev, char *what, unsigned char *addr,
 		       "buffer\n");
 
 	pid = change_tramp(argv, output, output_len);
-	if (pid < 0) return;
+	if (pid < 0) {
+		kfree(output);
+		return;
+	}
 
 	if (output != NULL) {
 		printk("%s", output);
-- 
1.7.0.4



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/