linux-kernel - Re: [PATCH v2 1/2] s390/kexec: check the return value of ipl_report

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YZOTO+37BbIwOpUK@osiris>
Date:   Tue, 16 Nov 2021 12:17:15 +0100
From:   Heiko Carstens <hca@...ux.ibm.com>
To:     Baoquan He <bhe@...hat.com>
Cc:     linux-kernel@...r.kernel.org, linux-s390@...r.kernel.org,
        kexec@...ts.infradead.org, prudo@...hat.com
Subject: Re: [PATCH v2 1/2] s390/kexec: check the return value of
 ipl_report_finish

On Tue, Nov 16, 2021 at 11:25:56AM +0800, Baoquan He wrote:
> In function ipl_report_finish(), it could fail by memory allocation
> failure, so check the return value to handle the case.
> 
> Signed-off-by: Baoquan He <bhe@...hat.com>
> ---
>  arch/s390/include/asm/ipl.h           | 2 +-
>  arch/s390/kernel/ipl.c                | 6 ++++--
>  arch/s390/kernel/machine_kexec_file.c | 5 ++++-
>  3 files changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h
> index 3f8ee257f9aa..864ab5d2890c 100644
> --- a/arch/s390/include/asm/ipl.h
> +++ b/arch/s390/include/asm/ipl.h
> @@ -122,7 +122,7 @@ struct ipl_report_certificate {
>  
>  struct kexec_buf;
>  struct ipl_report *ipl_report_init(struct ipl_parameter_block *ipib);
> -void *ipl_report_finish(struct ipl_report *report);
> +int ipl_report_finish(struct ipl_report *report, void **ipl_buf);
>  int ipl_report_free(struct ipl_report *report);
>  int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
>  			     unsigned char flags, unsigned short cert);
> diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
> index e2cc35775b99..a0af0b23148d 100644
> --- a/arch/s390/kernel/ipl.c
> +++ b/arch/s390/kernel/ipl.c
> @@ -2144,7 +2144,7 @@ struct ipl_report *ipl_report_init(struct ipl_parameter_block *ipib)
>  	return report;
>  }
>  
> -void *ipl_report_finish(struct ipl_report *report)
> +int ipl_report_finish(struct ipl_report *report, void **ipl_buf)
>  {
>  	struct ipl_report_certificate *cert;
>  	struct ipl_report_component *comp;
> @@ -2195,7 +2195,9 @@ void *ipl_report_finish(struct ipl_report *report)
>  	}
>  
>  	BUG_ON(ptr > buf + report->size);
> -	return buf;
> +	*ipl_buf = buf;
> +
> +	return 0;

This does not compile:

  CC      arch/s390/kernel/ipl.o
arch/s390/kernel/ipl.c: In function ‘ipl_report_finish’:
arch/s390/kernel/ipl.c:2159:24: warning: returning ‘void *’ from a function with return type ‘int’ makes integer from pointer without a cast [-Wint-conversion]
 2159 |                 return ERR_PTR(-ENOMEM);
      |                        ^~~~~~~~~~~~~~~~

Anyway, before we are going to have more iterations I just applied the
patch below instead before applying your memory leak fix.

>From 78e5f268d1be775354ab83c1e039dcfacaa5e258 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@...ux.ibm.com>
Date: Tue, 16 Nov 2021 11:06:38 +0100
Subject: s390/kexec: fix return code handling

kexec_file_add_ipl_report ignores that ipl_report_finish may fail and
can return an error pointer instead of a valid pointer.
Fix this and simplify by returning NULL in case of an error and let
the only caller handle this case.

Fixes: 99feaa717e55 ("s390/kexec_file: Create ipl report and pass to next kernel")
Signed-off-by: Heiko Carstens <hca@...ux.ibm.com>
---
 arch/s390/kernel/ipl.c                | 3 ++-
 arch/s390/kernel/machine_kexec_file.c | 8 +++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index e2cc35775b99..5ad1dde23dc5 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -2156,7 +2156,7 @@ void *ipl_report_finish(struct ipl_report *report)
 
 	buf = vzalloc(report->size);
 	if (!buf)
-		return ERR_PTR(-ENOMEM);
+		goto out;
 	ptr = buf;
 
 	memcpy(ptr, report->ipib, report->ipib->hdr.len);
@@ -2195,6 +2195,7 @@ void *ipl_report_finish(struct ipl_report *report)
 	}
 
 	BUG_ON(ptr > buf + report->size);
+out:
 	return buf;
 }
 
diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c
index 528edff085d9..f0200b503f94 100644
--- a/arch/s390/kernel/machine_kexec_file.c
+++ b/arch/s390/kernel/machine_kexec_file.c
@@ -170,6 +170,7 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 	struct kexec_buf buf;
 	unsigned long addr;
 	void *ptr, *end;
+	int ret;
 
 	buf.image = image;
 
@@ -199,7 +200,10 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 		ptr += len;
 	}
 
+	ret = -ENOMEM;
 	buf.buffer = ipl_report_finish(data->report);
+	if (!buf.buffer)
+		goto out;
 	buf.bufsz = data->report->size;
 	buf.memsz = buf.bufsz;
 
@@ -209,7 +213,9 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 		data->kernel_buf + offsetof(struct lowcore, ipl_parmblock_ptr);
 	*lc_ipl_parmblock_ptr = (__u32)buf.mem;
 
-	return kexec_add_buffer(&buf);
+	ret = kexec_add_buffer(&buf);
+out:
+	return ret;
 }
 
 void *kexec_file_add_components(struct kimage *image,
-- 
2.31.1