linux-kernel - [PATCH v2 3/3] device property: avoid allocations of 0 length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 23 Dec 2015 15:34:44 +0200
From:	Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To:	Stephen Rothwell <sfr@...b.auug.org.au>,
	linux-next@...r.kernel.org, akpm@...ux-foundation.org,
	linux-kernel@...r.kernel.org, heikki.krogerus@...ux.intel.com,
	"Rafael J. Wysocki" <rjw@...ysocki.net>, linux-acpi@...r.kernel.org
Cc:	Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
Subject: [PATCH v2 3/3] device property: avoid allocations of 0 length

Arrays can not have zero elements by definition of the unified device
properties. If such property comes from outside we should not allow it to pass.
Otherwise memory allocation on 0 length will return non-NULL value, which we
currently don't check.

Prevent memory allocations of 0 length.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
---
 drivers/base/property.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/base/property.c b/drivers/base/property.c
index 6c04d18..7e2061b 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -653,6 +653,9 @@ int fwnode_property_match_string(struct fwnode_handle *fwnode,
 	if (nval < 0)
 		return nval;
 
+	if (nval == 0)
+		return -ENODATA;
+
 	values = kcalloc(nval, sizeof(*values), GFP_KERNEL);
 	if (!values)
 		return -ENOMEM;
@@ -718,6 +721,9 @@ static int pset_copy_entry(struct property_entry *dst,
 		return -ENOMEM;
 
 	if (src->is_array) {
+		if (!src->length)
+			return -ENODATA;
+
 		if (src->is_string) {
 			nval = src->length / sizeof(const char *);
 			dst->pointer.str = kcalloc(nval, sizeof(const char *),
-- 
2.6.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/