linux-kernel - [PATCH] dm cache: handle kmalloc failure allocating background

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20170311190945.5930-1-colin.king@canonical.com>
Date:   Sat, 11 Mar 2017 19:09:45 +0000
From:   Colin King <colin.king@...onical.com>
To:     Alasdair Kergon <agk@...hat.com>,
        Mike Snitzer <snitzer@...hat.com>, dm-devel@...hat.com,
        Shaohua Li <shli@...nel.org>, linux-raid@...r.kernel.org
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] dm cache: handle kmalloc failure allocating background_tracker struct

From: Colin Ian King <colin.king@...onical.com>

currently there is no kmalloc failure check on the allocation of
the background_tracker struct variable b, and so a null return
will lead to a null pointer deference error. Add null check and move
the failure debug message and NULL return so that the two allocation
errors can share the same error exit path.

Detected by CoverityScan, CID#1416587 ("Dereference null return value")

Signed-off-by: Colin Ian King <colin.king@...onical.com>
---
 drivers/md/dm-cache-background-tracker.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-cache-background-tracker.c b/drivers/md/dm-cache-background-tracker.c
index 9b1afdf..d27edbcc 100644
--- a/drivers/md/dm-cache-background-tracker.c
+++ b/drivers/md/dm-cache-background-tracker.c
@@ -33,6 +33,8 @@ struct background_tracker *btracker_create(unsigned max_work)
 {
 	struct background_tracker *b = kmalloc(sizeof(*b), GFP_KERNEL);
 
+	if (!b)
+		goto err;
 	b->max_work = max_work;
 	atomic_set(&b->pending_promotes, 0);
 	atomic_set(&b->pending_writebacks, 0);
@@ -44,12 +46,15 @@ struct background_tracker *btracker_create(unsigned max_work)
 	b->pending = RB_ROOT;
 	b->work_cache = KMEM_CACHE(bt_work, 0);
 	if (!b->work_cache) {
-		DMERR("couldn't create mempool for background work items");
 		kfree(b);
-		b = NULL;
+		goto err;
 	}
 
 	return b;
+err:
+	DMERR("couldn't create mempool for background work items");
+	return NULL;
+
 }
 EXPORT_SYMBOL_GPL(btracker_create);
 
-- 
2.10.2