linux-kernel - Re: [PATCH] staging: vt6655: check for memory allocation failures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-id: <20180329015637.GA9416@ubuntu>
Date:   Thu, 29 Mar 2018 10:56:37 +0900
From:   Ji-Hun Kim <ji_hun.kim@...sung.com>
To:     baijiaju1990@...il.com, gregkh@...uxfoundation.org,
        forest@...ttletooquiet.net
Cc:     dartnorris@...il.com, santhameena13@...il.com,
        julia.lawall@...6.fr, y.k.oh@...sung.com,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] staging: vt6655: check for memory allocation failures

On Wed, Mar 28, 2018 at 05:55:57PM +0800, Jia-Ju Bai wrote:
> >@@ -646,7 +649,8 @@ static void device_init_td1_ring(struct vnt_private *priv)
> >  	     i++, curr += sizeof(struct vnt_tx_desc)) {
> >  		desc = &priv->apTD1Rings[i];
> >  		desc->td_info = kzalloc(sizeof(*desc->td_info), GFP_KERNEL);
> >-
> >+		if (WARN_ON(!desc->td_info))
> >+			return;
> >  		desc->td_info->buf = priv->tx1_bufs + i * PKT_BUF_SZ;
> >  		desc->td_info->buf_dma = priv->tx_bufs_dma1 + i * PKT_BUF_SZ;
> 
> I think the bugs you found are right.
> But your patch is not correct, because it is dangerous to return directly.
> I think you should return an error and then implement error handling
> code for these functions.
> 
Yes, it needs to free previous allocated values in the for loop. Directly
return could make memory leaks. I am going to make patch v2. 

- Delete WARN_ON which could make crashes on some machines.
- Add freeing sequences for previously allocated memory when kzalloc()
  failed instead of returning directly.

Does these changes would be fine on this bug?