lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Sat, 2 May 2020 17:57:29 +0200
From:   Sam Ravnborg <sam@...nborg.org>
To:     Nicolas Pitre <nico@...xnic.net>
Cc:     gregkh@...uxfoundation.org, jslaby@...e.com,
        daniel.vetter@...ll.ch, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] vt: fix unicode console freeing with a common interface

Hi Nicolas

On Sat, May 02, 2020 at 11:01:07AM -0400, Nicolas Pitre wrote:
> By directly using kfree() in different places we risk missing one if
> it is switched to using vfree(), especially if the corresponding
> vmalloc() is hidden away within a common abstraction.
> 
> Oh wait, that's exactly what happened here.
> 
> So let's fix this by creating a common abstraction for the free case
> as well.
> 
> Signed-off-by: Nicolas Pitre <nico@...xnic.net>
> Reported-by: syzbot+0bfda3ade1ee9288a1be@...kaller.appspotmail.com
> Fixes: 9a98e7a80f95 ("vt: don't use kmalloc() for the unicode screen buffer")
> Cc: <stable@...r.kernel.org>

Looks good.
Reviewed-by: Sam Ravnborg <sam@...nborg.org>

Not the I know the code, but verified that no more kfree() was
used for vc_uni_screen.

	Sam

> 
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index e5ffed795e..48a8199f78 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -365,9 +365,14 @@ static struct uni_screen *vc_uniscr_alloc(unsigned int cols, unsigned int rows)
>  	return uniscr;
>  }
>  
> +static void vc_uniscr_free(struct uni_screen *uniscr)
> +{
> +	vfree(uniscr);
> +}
> +
>  static void vc_uniscr_set(struct vc_data *vc, struct uni_screen *new_uniscr)
>  {
> -	vfree(vc->vc_uni_screen);
> +	vc_uniscr_free(vc->vc_uni_screen);
>  	vc->vc_uni_screen = new_uniscr;
>  }
>  
> @@ -1230,7 +1235,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
>  	err = resize_screen(vc, new_cols, new_rows, user);
>  	if (err) {
>  		kfree(newscreen);
> -		kfree(new_uniscr);
> +		vc_uniscr_free(new_uniscr);
>  		return err;
>  	}
>  

Powered by blists - more mailing lists