linux-kernel - Re: [PATCH] of: do not leak console options

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMuHMdXL1v20PvP2=jv_YdNgk0afkrgfZf1b21LrTWXGoPDMhg@mail.gmail.com>
Date:   Fri, 13 Oct 2017 21:48:34 +0200
From:   Geert Uytterhoeven <geert@...ux-m68k.org>
To:     Petr Mladek <pmladek@...e.com>
Cc:     Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>,
        Rob Herring <robh+dt@...nel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        "devicetree@...r.kernel.org" <devicetree@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>
Subject: Re: [PATCH] of: do not leak console options

On Tue, Oct 3, 2017 at 9:20 AM, Petr Mladek <pmladek@...e.com> wrote:
> On Tue 2017-09-26 15:25:10, Sergey Senozhatsky wrote:
>> Do not strdup() console options. It seems that the only reason for
>> it to be strdup()-ed was a compilation warning: printk, UART and
>> console drivers, for some reason, expect char pointer instead of
>> const char pointer. So we can just pass `of_stdout_options', but
>> need to cast it to char pointer. A better fix would be to change
>> printk, console drivers and UART to accept const char `options';
>> but that will take time - there are lots of drivers to update.
>>
>> The patch also fixes a possible memory leak: add_preferred_console()
>> can fail, but we don't kfree() options.
>>
>> Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@...il.com>
>
> Of course, it would be better to change add_preferred_console().
> But it would trigger many other changes. This alternative
> "temporary" change looks safe to me. Feel free to use

Really? Unless I'm missing something (it's been way too many hours after my
morning coffee), add_preferred_console() just calls __add_preferred_console(),
and the latter doesn't touch the passed string. As passing a "char *" to a
function that excepts a "const char *" is fine, you can just add "const" to
both add_preferred_console() and __add_preferred_console(), and be done with
it.

Repeat after me: casts are evil.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds