linux-kernel - Re: [PATCH] tty: vt: Add checks after calling kzalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <93064a89-872f-7e9c-fad9-92121919d736@I-love.SAKURA.ne.jp>
Date:   Wed, 31 Aug 2022 18:42:38 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:     Jiasheng Jiang <jiasheng@...as.ac.cn>
Cc:     jirislaby@...nel.org, ilpo.jarvinen@...ux.intel.com,
        johan@...nel.org, zhangxuezhi1@...lpad.com, xyangxi5@...il.com,
        linux-kernel@...r.kernel.org, gregkh@...uxfoundation.org
Subject: Re: [PATCH] tty: vt: Add checks after calling kzalloc

Please check if your system can survive, by doing

On 2022/08/31 18:08, Jiasheng Jiang wrote:
> On Wed, Aug 31, 2022 at 03:57:42PM +0800, Jiasheng Jiang wrote:
>>>  	for (currcons = 0; currcons < MIN_NR_CONSOLES; currcons++) {
>>>  		vc_cons[currcons].d = vc = kzalloc(sizeof(struct vc_data), GFP_NOWAIT);

-		vc_cons[currcons].d = vc = kzalloc(sizeof(struct vc_data), GFP_NOWAIT);
+		vc_cons[currcons].d = vc = NULL;

>>> +		if (!vc) {
>>> +			console_unlock();
>>> +			return -ENOMEM;
>>> +		}
>>>  		INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
>>>  		tty_port_init(&vc->port);
>>>  		visual_init(vc, currcons, 1);
>>>  		/* Assuming vc->vc_{cols,rows,screenbuf_size} are sane here. */
>>>  		vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);

and/or

-		vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);
+		vc->vc_screenbuf = NULL;

>>> +		if (!vc->vc_screenbuf) {
>>> +			console_unlock();
>>> +			return -ENOMEM;
>>> +		}

in addition to your patch.

This is __init function of built-in module, isn't it?
Who can recover from this allocation failure? ;-)