linux-kernel - [PATCH v2] ocfs2: quota_local: fix possible uninitialized-variable access in ocfs2_local_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210804014510.29430-1-islituo@gmail.com>
Date:   Tue,  3 Aug 2021 18:45:10 -0700
From:   Tuo Li <islituo@...il.com>
To:     mark@...heh.com, jlbec@...lplan.org, joseph.qi@...ux.alibaba.com
Cc:     ocfs2-devel@....oracle.com, linux-kernel@...r.kernel.org,
        baijiaju1990@...il.com, Tuo Li <islituo@...il.com>,
        TOTE Robot <oslab@...nghua.edu.cn>
Subject: [PATCH v2] ocfs2: quota_local: fix possible uninitialized-variable access in ocfs2_local_read_info()

A memory block is allocated through kmalloc(), and its return value is
assigned to the pointer oinfo. If the return value of
ocfs2_global_read_info() at line 709 is less than zero,
oinfo->dqi_gqinode may be not initialized. However, it is accessed at
line 775:
  iput(oinfo->dqi_gqinode);

To fix this possible uninitialized-variable access, replace kmalloc()
with kzalloc() when allocating memory for oinfo.

Reported-by: TOTE Robot <oslab@...nghua.edu.cn>
Signed-off-by: Tuo Li <islituo@...il.com>
---
v2:
* Replace kzalloc() with NULL assignment to oinfo->dqi_gqinode.
  Thank Joseph Qi for helpful advice.
---
 fs/ocfs2/quota_local.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index b1a8b046f4c2..de5aae584d5d 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -703,6 +703,7 @@ static int ocfs2_local_read_info(struct super_block *sb, int type)
 	oinfo->dqi_type = type;
 	INIT_LIST_HEAD(&oinfo->dqi_chunk);
 	oinfo->dqi_rec = NULL;
+	oinfo->dqi_gqinode = NULL;
 	oinfo->dqi_lqi_bh = NULL;
 	oinfo->dqi_libh = NULL;
 
-- 
2.25.1