| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 17 Jan 2020 06:38:02 +0300
From: Dan Carpenter <dan.carpenter@...cle.com>
To: kbuild@...ts.01.org, Taehee Yoo <ap420073@...il.com>
Cc: kbuild-all@...ts.01.org, davem@...emloft.net,
jakub.kicinski@...ronome.com, netdev@...r.kernel.org,
ap420073@...il.com
Subject: Re: [PATCH net 4/5] netdevsim: use IS_ERR instead of IS_ERR_OR_NULL
for debugfs
Hi Taehee,
url: https://github.com/0day-ci/linux/commits/Taehee-Yoo/netdevsim-fix-a-several-bugs-in-netdevsim-module/20200112-004546
base: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git a5c3a7c0ce1a1cfab15404018933775d7222a517
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
smatch warnings:
drivers/net/netdevsim/bpf.c:246 nsim_bpf_create_prog() error: dereferencing freed memory 'state'
# https://github.com/0day-ci/linux/commit/923e31529b0b3f039f837f54c4a1bbd77793256b
git remote add linux-review https://github.com/0day-ci/linux
git remote update linux-review
git checkout 923e31529b0b3f039f837f54c4a1bbd77793256b
vim +/state +246 drivers/net/netdevsim/bpf.c
d514f41e793d2c Jiri Pirko 2019-04-25 227 static int nsim_bpf_create_prog(struct nsim_dev *nsim_dev,
b26b6946a62f37 Jiri Pirko 2019-04-12 228 struct bpf_prog *prog)
31d3ad832948c7 Jakub Kicinski 2017-12-01 229 {
31d3ad832948c7 Jakub Kicinski 2017-12-01 230 struct nsim_bpf_bound_prog *state;
31d3ad832948c7 Jakub Kicinski 2017-12-01 231 char name[16];
31d3ad832948c7 Jakub Kicinski 2017-12-01 232
31d3ad832948c7 Jakub Kicinski 2017-12-01 233 state = kzalloc(sizeof(*state), GFP_KERNEL);
31d3ad832948c7 Jakub Kicinski 2017-12-01 234 if (!state)
31d3ad832948c7 Jakub Kicinski 2017-12-01 235 return -ENOMEM;
31d3ad832948c7 Jakub Kicinski 2017-12-01 236
d514f41e793d2c Jiri Pirko 2019-04-25 237 state->nsim_dev = nsim_dev;
31d3ad832948c7 Jakub Kicinski 2017-12-01 238 state->prog = prog;
31d3ad832948c7 Jakub Kicinski 2017-12-01 239 state->state = "verify";
31d3ad832948c7 Jakub Kicinski 2017-12-01 240
31d3ad832948c7 Jakub Kicinski 2017-12-01 241 /* Program id is not populated yet when we create the state. */
d514f41e793d2c Jiri Pirko 2019-04-25 242 sprintf(name, "%u", nsim_dev->prog_id_gen++);
d514f41e793d2c Jiri Pirko 2019-04-25 243 state->ddir = debugfs_create_dir(name, nsim_dev->ddir_bpf_bound_progs);
923e31529b0b3f Taehee Yoo 2020-01-11 244 if (IS_ERR(state->ddir)) {
31d3ad832948c7 Jakub Kicinski 2017-12-01 245 kfree(state);
^^^^^
state is freed.
923e31529b0b3f Taehee Yoo 2020-01-11 @246 return PTR_ERR(state->ddir);
^^^^^^^^^^^
Then dereferenced afterward.
31d3ad832948c7 Jakub Kicinski 2017-12-01 247 }
31d3ad832948c7 Jakub Kicinski 2017-12-01 248
31d3ad832948c7 Jakub Kicinski 2017-12-01 249 debugfs_create_u32("id", 0400, state->ddir, &prog->aux->id);
31d3ad832948c7 Jakub Kicinski 2017-12-01 250 debugfs_create_file("state", 0400, state->ddir,
31d3ad832948c7 Jakub Kicinski 2017-12-01 251 &state->state, &nsim_bpf_string_fops);
31d3ad832948c7 Jakub Kicinski 2017-12-01 252 debugfs_create_bool("loaded", 0400, state->ddir, &state->is_loaded);
31d3ad832948c7 Jakub Kicinski 2017-12-01 253
d514f41e793d2c Jiri Pirko 2019-04-25 254 list_add_tail(&state->l, &nsim_dev->bpf_bound_progs);
31d3ad832948c7 Jakub Kicinski 2017-12-01 255
31d3ad832948c7 Jakub Kicinski 2017-12-01 256 prog->aux->offload->dev_priv = state;
31d3ad832948c7 Jakub Kicinski 2017-12-01 257
31d3ad832948c7 Jakub Kicinski 2017-12-01 258 return 0;
31d3ad832948c7 Jakub Kicinski 2017-12-01 259 }
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org Intel Corporation
Powered by blists - more mailing lists