linux-kernel - Re: [PATCH v2] locktorture: Fix NULL pointer when torture

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 3 Mar 2016 12:31:47 +0800
From:	Kefeng Wang <wangkefeng.wang@...wei.com>
To:	<paulmck@...ux.vnet.ibm.com>, Davidlohr Bueso <dave@...olabs.net>
CC:	<linux-kernel@...r.kernel.org>, <peterz@...radead.org>,
	<mingo@...hat.com>, Josh Triplett <josh@...htriplett.org>,
	"Guohanjun (Hanjun Guo)" <guohanjun@...wei.com>
Subject: Re: [PATCH v2] locktorture: Fix NULL pointer when torture_type is
 invalid

Hi Davidlohr and Paul,

On 2016/3/3 9:37, Kefeng Wang wrote:
> 
> 
> On 2016/3/3 5:12, Paul E. McKenney wrote:
>> On Wed, Mar 02, 2016 at 11:55:43AM -0800, Davidlohr Bueso wrote:
>>> On Tue, 02 Feb 2016, Davidlohr Bueso wrote:
>>>
>>> I've just hit this issue myself and remembered this thread :)
>>>
>>> Paul, folks, does the below patch look reasonable to you? If so
>>> I can properly resend. thanks.
>>
>> If it works for Kefeng Wang, I would be happy to take it.
> 
> Yes, it works for me, tested on my board.
> 

Even if we merge Davidlohr's patch, I think we still need my v2 patch,
here is a scene,
----------
cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL);
if (cxt.lwsa == NULL) {
	goto unwind;
}

or

cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL);
if (cxt.lrsa == NULL) {
        VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory");
        firsterr = -ENOMEM;
        kfree(cxt.lwsa);
        goto unwind;
}
----------
we will get cxt.lwsa = NULL, and go to cleanup, then in

static void __torture_print_stats(char *page,
                                  struct lock_stress_stats *statp, bool write)
{
        bool fail = 0;
        int i, n_stress;
        long max = 0;
        long min = statp[0].n_lock_acquired;   // here, *we will meet NULL pointer dereference*

}

and my patch v2 solve this issue too, so it is still needed.

Thanks,
Kefeng


> 
>>
>> 							Thanx, Paul
>>
>