linux-kernel - Re: New Defect found by Coverity Scan based on code change in last 1.5 week

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 7 Jul 2012 09:28:11 +0800
From:	Cong Wang <xiyou.wangcong@...il.com>
To:	Scan Subscription <scan-subscription@...erity.com>
Cc:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"axboe@...nel.dk" <axboe@...nel.dk>,
	"roland@...estorage.com" <roland@...estorage.com>,
	"viro@...iv.linux.org.uk" <viro@...iv.linux.org.uk>,
	"jkosina@...e.cz" <jkosina@...e.cz>
Subject: Re: New Defect found by Coverity Scan based on code change in last
 1.5 week

On Sat, Jul 7, 2012 at 1:32 AM, Scan Subscription
<scan-subscription@...erity.com> wrote:
> ________________________________________________________________________
> CID 200075: Free of array-typed value (BAD_FREE.array)
>
> /linux/fs/splice.c: 317 ( array_assign)
>    311     struct page *pages[PIPE_DEF_BUFFERS];
>    312     struct partial_page partial[PIPE_DEF_BUFFERS];
> ...
>    316     int error, page_nr;
>>>> CID 200075: Free of array-typed value (BAD_FREE.array)
>>>> Assigning: "spd.pages" = "pages".
>    317     struct splice_pipe_desc spd = {
>    318      .pages = pages,
>    319      .partial = partial,
>    320      .nr_pages_max = PIPE_DEF_BUFFERS,
>    321      .flags = flags,
>
> /linux/fs/splice.c: 503 ( incorrect_free)
>    500     if (spd.nr_pages)
>    501      error = splice_to_pipe(pipe, &spd);
>    502
>>>> "splice_shrink_spd" frees incorrect pointer "spd.pages".
>    503     splice_shrink_spd(&spd);
>    504     return error;
>    505    }
>    506
>    507    /**

This one should be bogus, splice_shrink_spd() only
frees it when spd->nr_pages_max > PIPE_DEF_BUFFERS
because splice_grow_spd() only allocates memory
in that case. Otherwise, the array allocated on stack is
used.

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/