lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <618f886f-b2ff-4d50-cf74-e8478a7e8547@huaweicloud.com> Date: Wed, 27 Dec 2023 09:13:56 +0800 From: Hou Tao <houtao@...weicloud.com> To: Markus Elfring <Markus.Elfring@....de>, bpf@...r.kernel.org, linux-input@...r.kernel.org, kernel-janitors@...r.kernel.org, Alexei Starovoitov <ast@...nel.org>, Benjamin Tissoires <benjamin.tissoires@...hat.com>, David Vernet <void@...ifault.com>, Jiri Kosina <jikos@...nel.org> Cc: LKML <linux-kernel@...r.kernel.org>, cocci@...ia.fr Subject: Re: [PATCH] HID: bpf: One function call less in call_hid_bpf_rdesc_fixup() after error detection Hi, On 12/27/2023 2:24 AM, Markus Elfring wrote: > From: Markus Elfring <elfring@...rs.sourceforge.net> > Date: Tue, 26 Dec 2023 19:13:25 +0100 > > The kfree() function was called in one case by the > call_hid_bpf_rdesc_fixup() function during error handling > even if the passed data structure member contained a null pointer. > This issue was detected by using the Coccinelle software. It is totally OK to free a null pointer through kfree() and the ENOMEM case is an unlikely case, so I don't think the patch is necessary. > > Thus adjust jump targets. > > Signed-off-by: Markus Elfring <elfring@...rs.sourceforge.net> > --- > drivers/hid/bpf/hid_bpf_dispatch.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c > index d9ef45fcaeab..c84fe55be5ed 100644 > --- a/drivers/hid/bpf/hid_bpf_dispatch.c > +++ b/drivers/hid/bpf/hid_bpf_dispatch.c > @@ -118,17 +118,17 @@ u8 *call_hid_bpf_rdesc_fixup(struct hid_device *hdev, u8 *rdesc, unsigned int *s > > ctx_kern.data = kzalloc(ctx_kern.ctx.allocated_size, GFP_KERNEL); > if (!ctx_kern.data) > - goto ignore_bpf; > + goto dup_mem; > > memcpy(ctx_kern.data, rdesc, min_t(unsigned int, *size, HID_MAX_DESCRIPTOR_SIZE)); > > ret = hid_bpf_prog_run(hdev, HID_BPF_PROG_TYPE_RDESC_FIXUP, &ctx_kern); > if (ret < 0) > - goto ignore_bpf; > + goto free_data; > > if (ret) { > if (ret > ctx_kern.ctx.allocated_size) > - goto ignore_bpf; > + goto free_data; > > *size = ret; > } > @@ -137,8 +137,9 @@ u8 *call_hid_bpf_rdesc_fixup(struct hid_device *hdev, u8 *rdesc, unsigned int *s > > return rdesc; > > - ignore_bpf: > +free_data: > kfree(ctx_kern.data); > +dup_mem: > return kmemdup(rdesc, *size, GFP_KERNEL); > } > EXPORT_SYMBOL_GPL(call_hid_bpf_rdesc_fixup); > -- > 2.43.0 > > > .
Powered by blists - more mailing lists