linux-kernel - Re: [PATCH] list: test: potential dereference of null pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CABVgOS=suPzTKOnGvPKzpA4LnJGkXBjwD0_xEN-r80-o=pT3_w@mail.gmail.com>
Date:   Fri, 22 Sep 2023 15:22:58 +0800
From:   David Gow <davidgow@...gle.com>
To:     Ma Ke <make_ruc2021@....com>
Cc:     linux-kselftest@...r.kernel.org, kunit-dev@...glegroups.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] list: test: potential dereference of null pointer

On Thu, 21 Sept 2023 at 16:18, Ma Ke <make_ruc2021@....com> wrote:
>
> To avoid the failure of alloc, we could check the return value of
> kmalloc() and kzalloc().
>
> Signed-off-by: Ma Ke <make_ruc2021@....com>
> ---

Fair enough, though I'd want the test to fail in this case (or, at the
very least, be skipped).

Could we use KUNIT_ASSERT_NOT_NULL() here?

Furthermore, there are a few bugs in the patch, see below.

Cheers,
-- David

>  lib/list-test.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/lib/list-test.c b/lib/list-test.c
> index 0cc27de9cec8..9f82cac3a822 100644
> --- a/lib/list-test.c
> +++ b/lib/list-test.c
> @@ -27,9 +27,14 @@ static void list_test_list_init(struct kunit *test)
>         INIT_LIST_HEAD(&list2);
>
>         list4 = kzalloc(sizeof(*list4), GFP_KERNEL | __GFP_NOFAIL);
> +       if (!list4)
> +               return;

Instead, let's use:
KUNIT_ASSERT_NOT_NULL(test, list4)

>         INIT_LIST_HEAD(list4);
>
>         list5 = kmalloc(sizeof(*list5), GFP_KERNEL | __GFP_NOFAIL);
> +       if (!list5)

Shouldn't this be in {}s? We don't want to return unconditionally.

> +               kfree(list5);

We shouldn't free a NULL pointer. Should this be kfree(list4)?

Either way, maybe we should swap the allocations out for
kunit_kzalloc(), which will automatically free everything on test
exit.

> +               return;

Again, let's use KUNIT_ASSERT_NOT_NULL() here. Or at the very least,
call KUNIT_FAIL() to make sure we're noting the test has failed.

>         memset(list5, 0xFF, sizeof(*list5));
>         INIT_LIST_HEAD(list5);
>
> --
> 2.37.2
>

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4003 bytes)