linux-kernel - Re: [PATCH] scsi: scsi_debug: fix return checks for kcalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5a8772c3-7999-4675-59fe-c20ee2d66510@oracle.com>
Date:   Thu, 4 Nov 2021 11:21:36 -0400
From:   George Kennedy <george.kennedy@...cle.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     jejb@...ux.ibm.com, martin.petersen@...cle.com,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
        dan.carpenter@...cle.com
Subject: Re: [PATCH] scsi: scsi_debug: fix return checks for kcalloc

On 11/4/2021 2:25 AM, Greg KH wrote:
> On Wed, Nov 03, 2021 at 02:01:42PM -0500, George Kennedy wrote:
>> Change return checks from kcalloc() to now check for NULL and
>> ZERO_SIZE_PTR using the ZERO_OR_NULL_PTR macro or the following
>> crash can occur if ZERO_SIZE_PTR indicator is returned.
> That seems really broken in the api, why is kcalloc() returning
> ZERO_SIZE_PTR?
See Dan Carpenter's explanation.

kcalloc() purposely returns ZERO_SIZE_PTR if its size arg is zero.

See commit: 6cb8f91320d3e720351c21741da795fed580b21b

>
> Please fix that, otherwise you need to fix all callers in the kernel
> tree.

Here are the kcalloc() args:
/**
  * kcalloc - allocate memory for an array. The memory is set to zero.
  * @n: number of elements.
  * @size: element size.
  * @flags: the type of memory to allocate (see kmalloc).
  */
static inline void *kcalloc(size_t n, size_t size, gfp_t flags)

Any call to kcalloc() where the size arg (the 2nd arg) can possibly be 
zero needs to check for ZERO_SIZE_PTR being returned along with checking 
for NULL being returned, which the ZERO_OR_NULL_PTR macro does.

In most cases throughout the kernel the calls to kcalloc() are with the 
size arg set to a sizeof some data structure, so ZERO_SIZE_PTR will not 
be returned and a following check for NULL being returned is all that is 
needed.

Thank you,
George

>
> thanks,
>
> greg k-h