linux-kernel - Unchecked kmalloc() calls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <9f3ba19b-70cb-7631-9426-7aabacc1fdb6@gmail.com>
Date:   Wed, 3 Apr 2019 14:08:12 +0200
From:   Oliver Henning <oliver.henning@...il.com>
To:     linux-kernel@...r.kernel.org
Subject: Unchecked kmalloc() calls

Hello

I have written a Python script to scan the kernel for unchecked kmalloc() calls. It found the following instances. I checked them manually, too. I would like to fix them myself but I do not how to do a proper failure handling. So maybe someone else can have a look.

Oliver


drivers/net/wireless/rsi/rsi_91x_mac80211.c:199
             channels = kmalloc(sizeof(rsi_2ghz_channels), GFP_KERNEL);
             memcpy(channels,
                    rsi_2ghz_channels,
                    sizeof(rsi_2ghz_channels));
---
drivers/net/wireless/rsi/rsi_91x_mac80211.c:208
             channels = kmalloc(sizeof(rsi_5ghz_channels), GFP_KERNEL);
             memcpy(channels,
                    rsi_5ghz_channels,
                    sizeof(rsi_5ghz_channels));
---
arch/mips/pmcs-msp71xx/msp_prom.c:378
          argv = kmalloc(len, GFP_KERNEL);
          ptr = (char *) &argv[prom_argc + 1];    /* strings follow array */
    
          for (argc = 0; argc < prom_argc; argc++) {
               argv[argc] = ptr;
               strcpy(ptr, prom_argv[argc]);
               ptr += strlen(prom_argv[argc]) + 1;
          }
---
arch/mips/pmcs-msp71xx/msp_prom.c:399
          envp = kmalloc(len, GFP_KERNEL);
          ptr = (char *) &envp[i+1];
    
          for (argc = 0; argc < i; argc++) {
               envp[argc] = ptr;
               strcpy(ptr, prom_envp[argc]);
               ptr += strlen(prom_envp[argc]) + 1;
          }
---
arch/powerpc/platforms/pseries/dlpar.c:389
          hp_errlog_copy = kmalloc(sizeof(struct pseries_hp_errorlog),
                          GFP_KERNEL);
          memcpy(hp_errlog_copy, hp_errlog, sizeof(struct pseries_hp_errorlog));
---
drivers/media/pci/cx23885/cx23885-dvb.c:1477
                    fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
                    memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
---
/mnt/hgfs/Projekte/linux-master (1)/linux-master/drivers/misc/lkdtm/perms.c:135
          u32 *kmalloc_area = kmalloc(EXEC_SIZE, GFP_KERNEL);
          execute_location(kmalloc_area, CODE_WRITE);
          kfree(kmalloc_area);
     }
---
/mnt/hgfs/Projekte/linux-master (1)/linux-master/drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c:113
          new_compat = kmalloc(new_len, GFP_KERNEL);
    
          omapdss_prefix_strcpy(new_compat, new_len, prop->value, prop->length);
    
          omapdss_update_prop(node, new_compat, new_len);
     }
---
/mnt/hgfs/Projekte/linux-master (1)/linux-master/drivers/staging/media/davinci_vpfe/dm365_ipipe.c:1267
               params = kmalloc(sizeof(struct ipipe_module_params),
                          GFP_KERNEL);
               to = (void *)params + module_if->param_offset;
               size = module_if->param_size;
    
               if (to && from && size) {
                    if (copy_from_user(to, (void __user *)from, size)) {
                         rval = -EFAULT;
                         break;
                    }
---
/mnt/hgfs/Projekte/linux-master (1)/linux-master/drivers/staging/media/davinci_vpfe/dm365_ipipe.c:1309
               params = kmalloc(sizeof(struct ipipe_module_params),
                          GFP_KERNEL);
               from = (void *)params + module_if->param_offset;
               size = module_if->param_size;
    
               if (to && from && size) {
                    rval = module_if->get(ipipe, from);
                    if (rval)
                         goto error;
                    if (copy_to_user((void __user *)to, from, size)) {
---