linux-kernel - Re: [PATCH -next] iio: buffer: Check the return value of kstrdup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20211017144903.59ee0f59@jic23-huawei>
Date:   Sun, 17 Oct 2021 14:49:03 +0100
From:   Jonathan Cameron <jic23@...nel.org>
To:     Wang Wensheng <wangwensheng4@...wei.com>
Cc:     <lars@...afoo.de>, <alexandru.ardelean@...log.com>,
        <linux-iio@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <rui.xiang@...wei.com>
Subject: Re: [PATCH -next] iio: buffer: Check the return value of
 kstrdup_const()

On Mon, 11 Oct 2021 12:58:46 +0000
Wang Wensheng <wangwensheng4@...wei.com> wrote:

> We should check the duplication of attr.name properly in
> iio_buffer_wrap_attr() or a null-pointer-dereference would
> occur on destroying the related sysfs file.
> This issue is found by fault-injection.
> 
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> PGD 0 P4D 0
> Oops: 0000 [#1] SMP PTI
> RIP: 0010:strlen+0x0/0x20
> Call Trace:
>  kernfs_name_hash+0x1c/0xb0
>  kernfs_find_ns+0xc6/0x160
>  kernfs_remove_by_name_ns+0x5c/0xb0
>  remove_files.isra.1+0x42/0x90
>  internal_create_group+0x42f/0x460
>  internal_create_groups+0x49/0xc0
>  device_add+0xb5b/0xbe0
>  ? kobject_get+0x90/0xa0
>  cdev_device_add+0x2b/0x90
>  __iio_device_register+0xa56/0xb40
> 
> Fixes: 15097c7a1adc ("iio: buffer: wrap all buffer attributes into iio_dev_attr")
> Reported-by: Hulk Robot<hulkci@...wei.com>
> Signed-off-by: Wang Wensheng <wangwensheng4@...wei.com>
This version seems to be a duplicate with the version Yang Yingliang
sent a few days later, but that version has the free of the iio_attr which
is missing here.

Thanks,

Jonathan

> ---
>  drivers/iio/industrialio-buffer.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> index c648e9553edd..f4011c477bac 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -1312,6 +1312,8 @@ static struct attribute *iio_buffer_wrap_attr(struct iio_buffer *buffer,
>  	iio_attr->buffer = buffer;
>  	memcpy(&iio_attr->dev_attr, dattr, sizeof(iio_attr->dev_attr));
>  	iio_attr->dev_attr.attr.name = kstrdup_const(attr->name, GFP_KERNEL);
> +	if (!iio_attr->dev_attr.attr.name)
> +		return NULL;
>  	sysfs_attr_init(&iio_attr->dev_attr.attr);
>  
>  	list_add(&iio_attr->l, &buffer->buffer_attr_list);