linux-kernel - Re: [PATCH v2] initramfs: Fix a missing-chek bug in dir

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190523203523.8f638f378b54df0ef7a18f9d@linux-foundation.org>
Date:   Thu, 23 May 2019 20:35:23 -0700
From:   Andrew Morton <akpm@...ux-foundation.org>
To:     Gen Zhang <blackgod016574@...il.com>
Cc:     rppt@...ux.ibm.com, david.engraf@...go.com, steven.price@....com,
        osandov@...com, luc.vanoostenryck@...il.com, axboe@...nel.dk,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] initramfs: Fix a missing-chek bug in dir_add()

On Fri, 24 May 2019 11:30:45 +0800 Gen Zhang <blackgod016574@...il.com> wrote:

> In dir_add() and do_name(), de->name and vcollected are allocated by
> kstrdup(). And de->name and vcollected are dereferenced in the following
> codes. However, memory allocation functions such as kstrdup() may fail. 
> Dereferencing this null pointer may cause the kernel go wrong. Thus we
> should check these two kstrdup() operations.
> Further, if kstrdup() returns NULL, we should free de in dir_add().

We generally assume that memory allocations within __init code cannot
fail.  If one does fail, something quite horrid has happened.  The
resulting oops will provide the same information as the proposed panic()
anyway.