linux-kernel - Re: [PATCH] arch: x86: xen: check the return value of kasprintf()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 25 Feb 2022 14:27:44 +0100
From:   Juergen Gross <jgross@...e.com>
To:     Jia-Ju Bai <baijiaju1990@...il.com>, boris.ostrovsky@...cle.com,
        sstabellini@...nel.org, tglx@...utronix.de, mingo@...hat.com,
        bp@...en8.de, dave.hansen@...ux.intel.com, hpa@...or.com
Cc:     x86@...nel.org, xen-devel@...ts.xenproject.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] arch: x86: xen: check the return value of kasprintf()

On 25.02.22 09:11, Jia-Ju Bai wrote:
> The function kasprintf() can fail, but there is no check of its return
> value. To fix this bug, its return value should be checked with new
> error handling code.
> 
> Fixes: f87e4cac4f4e ("xen: SMP guest support")
> Fixes: 83b96794e0ea ("x86/xen: split off smp_pv.c")
> Fixes: d5de8841355a ("x86: split spinlock implementations out into their own files")
> Reported-by: TOTE Robot <oslab@...nghua.edu.cn>
> Signed-off-by: Jia-Ju Bai <baijiaju1990@...il.com>
> ---
>   arch/x86/xen/smp.c      | 2 ++
>   arch/x86/xen/smp_pv.c   | 2 ++
>   arch/x86/xen/spinlock.c | 2 ++
>   3 files changed, 6 insertions(+)
> 
> diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
> index c3e1f9a7d43a..91261390f8c0 100644
> --- a/arch/x86/xen/smp.c
> +++ b/arch/x86/xen/smp.c
> @@ -65,6 +65,8 @@ int xen_smp_intr_init(unsigned int cpu)
>   	char *resched_name, *callfunc_name, *debug_name;
>   
>   	resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu);
> +	if (!resched_name)
> +		return -ENOMEM;

There are 3 more instances of kasprintf() in this function.

>   	rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR,
>   				    cpu,
>   				    xen_reschedule_interrupt,
> diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
> index 4a6019238ee7..7d1471fd1267 100644
> --- a/arch/x86/xen/smp_pv.c
> +++ b/arch/x86/xen/smp_pv.c
> @@ -118,6 +118,8 @@ int xen_smp_intr_init_pv(unsigned int cpu)
>   	char *callfunc_name, *pmu_name;
>   
>   	callfunc_name = kasprintf(GFP_KERNEL, "irqwork%d", cpu);
> +	if (!callfunc_name)
> +		return -ENOMEM;

And in here is another one, too.

>   	rc = bind_ipi_to_irqhandler(XEN_IRQ_WORK_VECTOR,
>   				    cpu,
>   				    xen_irq_work_interrupt,
> diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
> index 043c73dfd2c9..ccdb9eddd93b 100644
> --- a/arch/x86/xen/spinlock.c
> +++ b/arch/x86/xen/spinlock.c
> @@ -75,6 +75,8 @@ void xen_init_lock_cpu(int cpu)
>   	     cpu, per_cpu(lock_kicker_irq, cpu));
>   
>   	name = kasprintf(GFP_KERNEL, "spinlock%d", cpu);
> +	if (!name)
> +		return;

Just failing silently is not nice.

>   	irq = bind_ipi_to_irqhandler(XEN_SPIN_UNLOCK_VECTOR,
>   				     cpu,
>   				     dummy_handler,


Juergen

Download attachment "OpenPGP_0xB0DE9DD628BF132F.asc" of type "application/pgp-keys" (3099 bytes)

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (496 bytes)