linux-kernel - Re: scsi: ses: Move a label in ses_enclosure_data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 30 Dec 2023 08:04:32 +0100
From: Markus Elfring <Markus.Elfring@....de>
To: James Bottomley <jejb@...ux.ibm.com>, linux-scsi@...r.kernel.org,
 kernel-janitors@...r.kernel.org,
 "Martin K. Petersen" <martin.petersen@...cle.com>
Cc: LKML <linux-kernel@...r.kernel.org>
Subject: Re: scsi: ses: Move a label in ses_enclosure_data_process()

>> The kfree() function was called in up to three cases by
>> the ses_enclosure_data_process() function during error handling
>> even if the passed variable contained a null pointer.
>> This issue was detected by using the Coccinelle software.
>
> Why is this an issue?  The whole point of having kfree(NULL) be a nop

Such “a nop” can trigger the allocation of extra data processing resources,
can't it?

> is so we don't have to special case the free path.

A bit more development attention can hopefully connect the mentioned label
with a more appropriate jump target directly.

>                                                     The reason we do
> that is because multiple special case paths through code leads to more
> complex control flows and more potential bugs.

You probably know some advices from another information source.

https://wiki.sei.cmu.edu/confluence/display/c/MEM12-C.+Consider+using+a+goto+chain+when+leaving+a+function+on+error+when+using+and+releasing+resources

>                                                 If coccinelle suddenly
> thinks this is a problem, it's coccinelle that needs fixing.

This software tool can help to point source code places out for further considerations.
The search patterns are evolving accordingly.

Regards,
Markus