linux-kernel - Re: [PATCH -next] lib: fix test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <fae8934b-7300-27ff-e18e-6db413b9ea53@nvidia.com>
Date:   Thu, 18 Jun 2020 09:21:57 -0700
From:   Ralph Campbell <rcampbell@...dia.com>
To:     Randy Dunlap <rdunlap@...radead.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Linux MM <linux-mm@...ck.org>
CC:     Jérôme Glisse <jglisse@...hat.com>
Subject: Re: [PATCH -next] lib: fix test_hmm.c reference after free


On 6/17/20 10:31 PM, Randy Dunlap wrote:
> From: Randy Dunlap <rdunlap@...radead.org>
> 
> Coccinelle scripts report the following errors:
> 
> lib/test_hmm.c:523:20-26: ERROR: reference preceded by free on line 521
> lib/test_hmm.c:524:21-27: ERROR: reference preceded by free on line 521
> lib/test_hmm.c:523:28-35: ERROR: devmem is NULL but dereferenced.
> lib/test_hmm.c:524:29-36: ERROR: devmem is NULL but dereferenced.
> 
> Fix these by using the local variable 'res' instead of devmem.
> 
> Signed-off-by: Randy Dunlap <rdunlap@...radead.org>
> Cc: Jérôme Glisse <jglisse@...hat.com>
> Cc: linux-mm@...ck.org
> Cc: Ralph Campbell <rcampbell@...dia.com>
> ---
>   lib/test_hmm.c |    3 +--
>   1 file changed, 1 insertion(+), 2 deletions(-)
> 
> --- linux-next-20200617.orig/lib/test_hmm.c
> +++ linux-next-20200617/lib/test_hmm.c
> @@ -520,8 +520,7 @@ static bool dmirror_allocate_chunk(struc
>   err_free:
>   	kfree(devmem);
>   err_release:
> -	release_mem_region(devmem->pagemap.res.start,
> -			   resource_size(&devmem->pagemap.res));
> +	release_mem_region(res->start, resource_size(res));
>   err:
>   	mutex_unlock(&mdevice->devmem_lock);
>   	return false;
> 

Thanks for fixing this!
Reviewed-by: Ralph Campbell <rcampbell@...dia.com>