linux-kernel - Re: [PATCH v2 1/2] s390/kexec: check the return value of ipl_report

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 16 Nov 2021 21:39:47 +0800
From:   Baoquan He <bhe@...hat.com>
To:     Heiko Carstens <hca@...ux.ibm.com>
Cc:     linux-kernel@...r.kernel.org, linux-s390@...r.kernel.org,
        kexec@...ts.infradead.org, prudo@...hat.com
Subject: Re: [PATCH v2 1/2] s390/kexec: check the return value of
 ipl_report_finish

On 11/16/21 at 12:17pm, Heiko Carstens wrote:
> On Tue, Nov 16, 2021 at 11:25:56AM +0800, Baoquan He wrote:
> > In function ipl_report_finish(), it could fail by memory allocation
> > failure, so check the return value to handle the case.
> > 
> > Signed-off-by: Baoquan He <bhe@...hat.com>
> > ---
> >  arch/s390/include/asm/ipl.h           | 2 +-
> >  arch/s390/kernel/ipl.c                | 6 ++++--
> >  arch/s390/kernel/machine_kexec_file.c | 5 ++++-
> >  3 files changed, 9 insertions(+), 4 deletions(-)
> > 
> > diff --git a/arch/s390/include/asm/ipl.h b/arch/s390/include/asm/ipl.h
> > index 3f8ee257f9aa..864ab5d2890c 100644
> > --- a/arch/s390/include/asm/ipl.h
> > +++ b/arch/s390/include/asm/ipl.h
> > @@ -122,7 +122,7 @@ struct ipl_report_certificate {
> >  
> >  struct kexec_buf;
> >  struct ipl_report *ipl_report_init(struct ipl_parameter_block *ipib);
> > -void *ipl_report_finish(struct ipl_report *report);
> > +int ipl_report_finish(struct ipl_report *report, void **ipl_buf);
> >  int ipl_report_free(struct ipl_report *report);
> >  int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
> >  			     unsigned char flags, unsigned short cert);
> > diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
> > index e2cc35775b99..a0af0b23148d 100644
> > --- a/arch/s390/kernel/ipl.c
> > +++ b/arch/s390/kernel/ipl.c
> > @@ -2144,7 +2144,7 @@ struct ipl_report *ipl_report_init(struct ipl_parameter_block *ipib)
> >  	return report;
> >  }
> >  
> > -void *ipl_report_finish(struct ipl_report *report)
> > +int ipl_report_finish(struct ipl_report *report, void **ipl_buf)
> >  {
> >  	struct ipl_report_certificate *cert;
> >  	struct ipl_report_component *comp;
> > @@ -2195,7 +2195,9 @@ void *ipl_report_finish(struct ipl_report *report)
> >  	}
> >  
> >  	BUG_ON(ptr > buf + report->size);
> > -	return buf;
> > +	*ipl_buf = buf;
> > +
> > +	return 0;
> 
> This does not compile:
> 
>   CC      arch/s390/kernel/ipl.o
> arch/s390/kernel/ipl.c: In function ‘ipl_report_finish’:
> arch/s390/kernel/ipl.c:2159:24: warning: returning ‘void *’ from a function with return type ‘int’ makes integer from pointer without a cast [-Wint-conversion]
>  2159 |                 return ERR_PTR(-ENOMEM);
>       |                        ^~~~~~~~~~~~~~~~

Oops, I forgot changing this place to "return -ENOMEM;". Thanks for
taking care of it with below patch.
> 
> Anyway, before we are going to have more iterations I just applied the
> patch below instead before applying your memory leak fix.
> 
> From 78e5f268d1be775354ab83c1e039dcfacaa5e258 Mon Sep 17 00:00:00 2001
> From: Heiko Carstens <hca@...ux.ibm.com>
> Date: Tue, 16 Nov 2021 11:06:38 +0100
> Subject: s390/kexec: fix return code handling
> 
> kexec_file_add_ipl_report ignores that ipl_report_finish may fail and
> can return an error pointer instead of a valid pointer.
> Fix this and simplify by returning NULL in case of an error and let
> the only caller handle this case.
> 
> Fixes: 99feaa717e55 ("s390/kexec_file: Create ipl report and pass to next kernel")
> Signed-off-by: Heiko Carstens <hca@...ux.ibm.com>
> ---
>  arch/s390/kernel/ipl.c                | 3 ++-
>  arch/s390/kernel/machine_kexec_file.c | 8 +++++++-
>  2 files changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
> index e2cc35775b99..5ad1dde23dc5 100644
> --- a/arch/s390/kernel/ipl.c
> +++ b/arch/s390/kernel/ipl.c
> @@ -2156,7 +2156,7 @@ void *ipl_report_finish(struct ipl_report *report)
>  
>  	buf = vzalloc(report->size);
>  	if (!buf)
> -		return ERR_PTR(-ENOMEM);
> +		goto out;
>  	ptr = buf;
>  
>  	memcpy(ptr, report->ipib, report->ipib->hdr.len);
> @@ -2195,6 +2195,7 @@ void *ipl_report_finish(struct ipl_report *report)
>  	}
>  
>  	BUG_ON(ptr > buf + report->size);
> +out:
>  	return buf;
>  }
>  
> diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c
> index 528edff085d9..f0200b503f94 100644
> --- a/arch/s390/kernel/machine_kexec_file.c
> +++ b/arch/s390/kernel/machine_kexec_file.c
> @@ -170,6 +170,7 @@ static int kexec_file_add_ipl_report(struct kimage *image,
>  	struct kexec_buf buf;
>  	unsigned long addr;
>  	void *ptr, *end;
> +	int ret;
>  
>  	buf.image = image;
>  
> @@ -199,7 +200,10 @@ static int kexec_file_add_ipl_report(struct kimage *image,
>  		ptr += len;
>  	}
>  
> +	ret = -ENOMEM;
>  	buf.buffer = ipl_report_finish(data->report);
> +	if (!buf.buffer)
> +		goto out;
>  	buf.bufsz = data->report->size;
>  	buf.memsz = buf.bufsz;
>  
> @@ -209,7 +213,9 @@ static int kexec_file_add_ipl_report(struct kimage *image,
>  		data->kernel_buf + offsetof(struct lowcore, ipl_parmblock_ptr);
>  	*lc_ipl_parmblock_ptr = (__u32)buf.mem;
>  
> -	return kexec_add_buffer(&buf);
> +	ret = kexec_add_buffer(&buf);
> +out:
> +	return ret;
>  }
>  
>  void *kexec_file_add_components(struct kimage *image,
> -- 
> 2.31.1
>