linux-kernel - [BUG] errors in void transport_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAAeU0aOn80JuaFtmfod8Eh=VkA7i6CTYYD+xwEVNU8auEGHQ_A@mail.gmail.com>
Date:   Wed, 12 Oct 2016 11:51:47 -0700
From:   Tahsin Erdogan <tahsin@...gle.com>
To:     linux-kernel@...r.kernel.org
Subject: [BUG] errors in void transport_add_device() function

transport_add_device() is declared as void but it can actually fail.
Since the caller has no knowledge of the error, a later call to
transport_remove_device() may cause a kernel crash.

An example is a memory allocation error in this call path:

int device_private_init(struct device *dev)
{
        dev->p = kzalloc(sizeof(*dev->p), GFP_KERNEL);

device_private_init
device_add
attribute_container_add_class_device
transport_add_class_device
attribute_container_device_trigger
transport_add_device


This results in a NULL pointer access in device_del():

        if (parent)
                klist_del(&dev->p->knode_parent);

klist_del
device_del
attribute_container_class_device_del
transport_remove_classdev
attribute_container_device_trigger
transport_remove_device