linux-kernel - Re: [Patch] kernel/sys.c: fix an incorrect error branch in orderly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 11 Jul 2012 16:23:23 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Cong Wang <amwang@...hat.com>
Cc:	linux-kernel@...r.kernel.org, WANG Cong <xiyou.wangcong@...il.com>,
	Cyrill Gorcunov <gorcunov@...nvz.org>,
	Kees Cook <keescook@...omium.org>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Alan Cox <alan@...rguk.ukuu.org.uk>
Subject: Re: [Patch] kernel/sys.c: fix an incorrect error branch in
 orderly_poweroff()

On Wed,  4 Jul 2012 11:31:47 +0800
Cong Wang <amwang@...hat.com> wrote:

> From: WANG Cong <xiyou.wangcong@...il.com>
> 
> When argv_split() fails, argv is NULL, thus we should avoid calling
> agrv_free(argv), and should jump after it.
> 
> Cc: Cyrill Gorcunov <gorcunov@...nvz.org>
> Cc: Kees Cook <keescook@...omium.org>
> Cc: Serge Hallyn <serge.hallyn@...onical.com>
> Cc: "Eric W. Biederman" <ebiederm@...ssion.com>
> Cc: Andrew Morton <akpm@...ux-foundation.org>
> Signed-off-by: WANG Cong <xiyou.wangcong@...il.com>
> 
> ---
> diff --git a/kernel/sys.c b/kernel/sys.c
> index e0c8ffc..ffa510f 100644
> --- a/kernel/sys.c
> +++ b/kernel/sys.c
> @@ -2217,13 +2217,13 @@ int orderly_poweroff(bool force)
>  
>  	ret = call_usermodehelper_fns(argv[0], argv, envp, UMH_NO_WAIT,
>  				      NULL, argv_cleanup, NULL);
> -out:
>  	if (likely(!ret))
>  		return 0;
>  
>  	if (ret == -ENOMEM)
>  		argv_free(argv);
>  
> +out:
>  	if (force) {
>  		printk(KERN_WARNING "Failed to start orderly shutdown: "
>  		       "forcing the issue\n");

That code's still pretty stupid-looking, and it's such convoluted code
which leads to bugs of this nature.

Please, always feel free to step back a bit and think about the overall
structure, see if it can be improved.


eg...


From: Andrew Morton <akpm@...ux-foundation.org>
Subject: kernel/sys.c: avoid argv_free(NULL)

If argv_split() failed, the code will end up calling argv_free(NULL).  Fix
it up and clean things up a bit.

Addresses Coverity report 703573.

Cc: Cyrill Gorcunov <gorcunov@...nvz.org>
Cc: Kees Cook <keescook@...omium.org>
Cc: Serge Hallyn <serge.hallyn@...onical.com>
Cc: "Eric W. Biederman" <ebiederm@...ssion.com>
Cc: WANG Cong <xiyou.wangcong@...il.com>
Cc: Alan Cox <alan@...ux.intel.com>
Cc: David Rientjes <rientjes@...gle.com>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---

 kernel/sys.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff -puN kernel/sys.c~kernel-sysc-avoid-argv_freenull kernel/sys.c
--- a/kernel/sys.c~kernel-sysc-avoid-argv_freenull
+++ a/kernel/sys.c
@@ -2196,25 +2196,25 @@ static void argv_cleanup(struct subproce
 int orderly_poweroff(bool force)
 {
 	int argc;
-	char **argv = argv_split(GFP_ATOMIC, poweroff_cmd, &argc);
+	char **argv;
 	static char *envp[] = {
 		"HOME=/",
 		"PATH=/sbin:/bin:/usr/sbin:/usr/bin",
 		NULL
 	};
-	int ret = -ENOMEM;
+	int ret;
 
+	argv = argv_split(GFP_ATOMIC, poweroff_cmd, &argc);
 	if (argv == NULL) {
 		printk(KERN_WARNING "%s failed to allocate memory for \"%s\"\n",
 		       __func__, poweroff_cmd);
-		goto out;
+		return -ENOMEM;
 	}
 
 	ret = call_usermodehelper_fns(argv[0], argv, envp, UMH_NO_WAIT,
 				      NULL, argv_cleanup, NULL);
-out:
 	if (likely(!ret))
-		return 0;
+		return 0;		/* success */
 
 	if (ret == -ENOMEM)
 		argv_free(argv);
_

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/