linux-kernel - Re: [PATCH] tools/io_uring: Fix missing check for return value of malloc()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 15 Jun 2023 07:13:31 -0600
From:   Jens Axboe <axboe@...nel.dk>
To:     Ammar Faizi <ammarfaizi2@...weeb.org>,
        Chenyuan Mi <cymi20@...an.edu.cn>
Cc:     Pavel Begunkov <asml.silence@...il.com>,
        io-uring Mailing List <io-uring@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] tools/io_uring: Fix missing check for return value of
 malloc()

On 6/15/23 7:00?AM, Ammar Faizi wrote:
> On 6/15/23 7:50 PM, Chenyuan Mi wrote:
>> The malloc() function may return NULL when it fails,
>> which may cause null pointer deference in kmalloc(),
> 
> It's a userspace app, there is no kmalloc(). Also, I don't think it's
> worth to fix a missing ENOMEM handling for that old test program. But
> anyway, let's wait for maintainers' comment on this.

Definitely not worth it, and I find it odd how the author would target
just one of multiple allocations in that file. I'm guessing it's because
this checker only checks for malloc(), and no thought has otherwise gone
into a) if the patch makes any sense at all, and b) if it does make
sense, are there potentially other cases to consider?

-- 
Jens Axboe