linux-kernel - Re: [PATCH v2] ntb_tool: check null return of devm_kcalloc in tool_init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e4ac3d74-9a91-e4ff-eee3-67237f35ac7b@intel.com>
Date:   Tue, 7 Mar 2023 09:05:38 -0700
From:   Dave Jiang <dave.jiang@...el.com>
To:     Kang Chen <void0red@...il.com>, fancer.lancer@...il.com
Cc:     allenbh@...il.com, jdmason@...zu.us, linux-kernel@...r.kernel.org,
        ntb@...ts.linux.dev
Subject: Re: [PATCH v2] ntb_tool: check null return of devm_kcalloc in
 tool_init_mws



On 3/7/23 5:20 AM, Kang Chen wrote:
> devm_kcalloc may fails, tc->peers[pidx].outmws might be null
> and will cause null pointer dereference later.
> 
> Fixes: 7f46c8b3a552 ("NTB: ntb_tool: Add full multi-port NTB API support")
> Signed-off-by: Kang Chen <void0red@...il.com>
> Reviewed-by: Serge Semin <fancer.lancer@...il.com>

You forgot to pick up my review tag. I do recommend using the tool 'b4'. 
It picks up all the tags for you and works rather well.

> ---
> v2 -> v1: add Fixes and Reviewed-by tags
> 
>   drivers/ntb/test/ntb_tool.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
> index 5ee0afa62..eeeb4b1c9 100644
> --- a/drivers/ntb/test/ntb_tool.c
> +++ b/drivers/ntb/test/ntb_tool.c
> @@ -998,6 +998,8 @@ static int tool_init_mws(struct tool_ctx *tc)
>   		tc->peers[pidx].outmws =
>   			devm_kcalloc(&tc->ntb->dev, tc->peers[pidx].outmw_cnt,
>   				   sizeof(*tc->peers[pidx].outmws), GFP_KERNEL);
> +		if (tc->peers[pidx].outmws == NULL)
> +			return -ENOMEM;
>   
>   		for (widx = 0; widx < tc->peers[pidx].outmw_cnt; widx++) {
>   			tc->peers[pidx].outmws[widx].pidx = pidx;