linux-kernel - Re: [PATCH v2] ntb_tool: check null return of devm_kcalloc in tool_init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 8 Mar 2023 00:26:17 +0800
From:   Kang Chen <void0red@...il.com>
To:     Dave Jiang <dave.jiang@...el.com>
Cc:     fancer.lancer@...il.com, allenbh@...il.com, jdmason@...zu.us,
        linux-kernel@...r.kernel.org, ntb@...ts.linux.dev
Subject: Re: [PATCH v2] ntb_tool: check null return of devm_kcalloc in tool_init_mws

What a cool tool, thanks for your suggestions.

On Wed, Mar 8, 2023 at 12:06 AM Dave Jiang <dave.jiang@...el.com> wrote:
>
>
>
> On 3/7/23 5:20 AM, Kang Chen wrote:
> > devm_kcalloc may fails, tc->peers[pidx].outmws might be null
> > and will cause null pointer dereference later.
> >
> > Fixes: 7f46c8b3a552 ("NTB: ntb_tool: Add full multi-port NTB API support")
> > Signed-off-by: Kang Chen <void0red@...il.com>
> > Reviewed-by: Serge Semin <fancer.lancer@...il.com>
>
> You forgot to pick up my review tag. I do recommend using the tool 'b4'.
> It picks up all the tags for you and works rather well.
>
> > ---
> > v2 -> v1: add Fixes and Reviewed-by tags
> >
> >   drivers/ntb/test/ntb_tool.c | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/ntb/test/ntb_tool.c b/drivers/ntb/test/ntb_tool.c
> > index 5ee0afa62..eeeb4b1c9 100644
> > --- a/drivers/ntb/test/ntb_tool.c
> > +++ b/drivers/ntb/test/ntb_tool.c
> > @@ -998,6 +998,8 @@ static int tool_init_mws(struct tool_ctx *tc)
> >               tc->peers[pidx].outmws =
> >                       devm_kcalloc(&tc->ntb->dev, tc->peers[pidx].outmw_cnt,
> >                                  sizeof(*tc->peers[pidx].outmws), GFP_KERNEL);
> > +             if (tc->peers[pidx].outmws == NULL)
> > +                     return -ENOMEM;
> >
> >               for (widx = 0; widx < tc->peers[pidx].outmw_cnt; widx++) {
> >                       tc->peers[pidx].outmws[widx].pidx = pidx;