linux-kernel - Re: [PATCH] scsi: lpfc: add null check of kzalloc in lpfc_sli4_cgn_params

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 27 Feb 2023 20:12:21 -0800
From:   Justin Tee <justintee8345@...il.com>
To:     Kang Chen <void0red@...il.com>
Cc:     jejb@...ux.ibm.com, martin.petersen@...cle.com,
        james.smart@...adcom.com, dick.kennedy@...adcom.com,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
        Justin Tee <justin.tee@...adcom.com>
Subject: Re: [PATCH] scsi: lpfc: add null check of kzalloc in lpfc_sli4_cgn_params_read

Hi Kang,

Thanks for reporting this.

Technically, the lpfc_read_object routine already NULL checks pdata,
and if it was NULL would return -ENODEV.  Then, else if (ret < 0)
would evaluate to true and we'd goto rd_obj_err.

However, we like the suggestion to return -ENOMEM instead.  I will
post a v2 of this patch to address both concerns.

Thanks,
Justin

On Sun, Feb 26, 2023 at 2:48 AM Kang Chen <void0red@...il.com> wrote:
>
> kzalloc may fails, pdata might be null and it may cause
> null pointer dereference later.
>
> Signed-off-by: Kang Chen <void0red@...il.com>
> ---
>  drivers/scsi/lpfc/lpfc_init.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
> index 6eb4085a3..54134d782 100644
> --- a/drivers/scsi/lpfc/lpfc_init.c
> +++ b/drivers/scsi/lpfc/lpfc_init.c
> @@ -7291,6 +7291,8 @@ lpfc_sli4_cgn_params_read(struct lpfc_hba *phba)
>         /* Find out if the FW has a new set of congestion parameters. */
>         len = sizeof(struct lpfc_cgn_param);
>         pdata = kzalloc(len, GFP_KERNEL);
> +       if (!pdata)
> +               return -ENOMEM;
>         ret = lpfc_read_object(phba, (char *)LPFC_PORT_CFG_NAME,
>                                pdata, len);
>
> --
> 2.34.1
>