linux-kernel - Re: [PATCH] mmc: mmc_test: Fix NULL dereference on allocation failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAPDyKFrdNWTsP_cKM4+RmmL-j=nu+r2HktFRxGxhcOhPcSt8vA@mail.gmail.com>
Date: Tue, 20 Aug 2024 13:50:07 +0200
From: Ulf Hansson <ulf.hansson@...aro.org>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: Pierre Ossman <drzeus@...eus.cx>, Adrian Hunter <adrian.hunter@...el.com>, linux-mmc@...r.kernel.org, 
	linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] mmc: mmc_test: Fix NULL dereference on allocation failure

On Tue, 20 Aug 2024 at 10:44, Dan Carpenter <dan.carpenter@...aro.org> wrote:
>
> If the "test->highmem = alloc_pages()" allocation fails then calling
> __free_pages(test->highmem) will result in a NULL dereference.  Also
> change the error code to -ENOMEM instead of returning success.
>
> Fixes: 2661081f5ab9 ("mmc_test: highmem tests")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>

Applied for fixes, thanks!

Kind regards
Uffe


> ---
> This code is from 2008 so it must not be that much of an issue in real
> life.
>
>  drivers/mmc/core/mmc_test.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c
> index 8f7f587a0025..b7f627a9fdea 100644
> --- a/drivers/mmc/core/mmc_test.c
> +++ b/drivers/mmc/core/mmc_test.c
> @@ -3125,13 +3125,13 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf,
>         test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL);
>  #ifdef CONFIG_HIGHMEM
>         test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER);
> +       if (!test->highmem) {
> +               count = -ENOMEM;
> +               goto free_test_buffer;
> +       }
>  #endif
>
> -#ifdef CONFIG_HIGHMEM
> -       if (test->buffer && test->highmem) {
> -#else
>         if (test->buffer) {
> -#endif
>                 mutex_lock(&mmc_test_lock);
>                 mmc_test_run(test, testcase);
>                 mutex_unlock(&mmc_test_lock);
> @@ -3139,6 +3139,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf,
>
>  #ifdef CONFIG_HIGHMEM
>         __free_pages(test->highmem, BUFFER_ORDER);
> +free_test_buffer:
>  #endif
>         kfree(test->buffer);
>         kfree(test);
> --
> 2.43.0
>