linux-kernel - [PATCH] tty/n_gsm.c: fix false positive WARN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 25 Nov 2015 19:18:37 +0800
From:	xinhui <xinhui.pan@...ux.vnet.ibm.com>
To:	linux-kernel@...r.kernel.org
CC:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jiri Slaby <jslaby@...e.com>, dvyukov@...gle.com,
	yanmin_zhang@...ux.intel.com
Subject: [PATCH] tty/n_gsm.c: fix false positive WARN_ON and do some codes
 improvement

From: xinhui <xinhui@...ux.vnet.ibm.com>

If gsm driver fails to activate one mux, and this mux is not stored in
gsm_mux[], there would be a warning in gsm_cleanup_mux(). Actually this
is a legal case. So just do a simple check instead of WARN_ON.

There is one filed gsm->num to store its index of gsm_mux[]. So use
gsm->num to remove itself from gsm_mux[] instead of the for-loop
traverse.

Reported-by: Dmitry Vyukov <dvyukov@...gle.com>
Fixes: 5a64096700dc ("tty/n_gsm.c: fix a memory leak in gsmld_open")
Signed-off-by: Pan Xinhui <xinhui.pan@...ux.vnet.ibm.com>
---
 drivers/tty/n_gsm.c |   12 +++++-------
 1 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index c3fe026..56377e1 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2037,15 +2037,13 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm)
 
 	gsm->dead = 1;
 
+	/* open failed before registering => nothing to do*/
+	if (gsm_mux[gsm->num] != gsm)
+		return;
+
 	spin_lock(&gsm_mux_lock);
-	for (i = 0; i < MAX_MUX; i++) {
-		if (gsm_mux[i] == gsm) {
-			gsm_mux[i] = NULL;
-			break;
-		}
-	}
+	gsm_mux[gsm->num] = NULL;
 	spin_unlock(&gsm_mux_lock);
-	WARN_ON(i == MAX_MUX);
 
 	/* In theory disconnecting DLCI 0 is sufficient but for some
 	   modems this is apparently not the case. */
-- 
1.7.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/