From patchwork Tue Jun 5 08:27:30 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anton Ivanov X-Patchwork-Id: 925414 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-um-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=cambridgegreys.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="VuBe/78O"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 410VKb4r3Pz9s0W for ; Tue, 5 Jun 2018 21:42:43 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=cTpOV5SBZ17fKEE8C24XPgSg+JtzLEXekgE1Sk2QJI8=; b=VuB e/78OoBlvI4AsdLWnnq5aRmiOZfJw5h9LTEay7OkQbsU0leageC4aYGgrJGbXDPy2YcDEvbic9ztf 1aod6hp40njyPlqAU3lR6zJgDBm6zSvKYEoNaKX44OOx/3ph735YXixAu0I37MH3pskaNkXlYdPHf MNleNLBDu4jBjZ/Q/Jtkl1AmwSfVD53jFf9hwE+hMg1B9s3mXIqt9GVeqem1aqFw+UWlMNLpkWnyi 0WWplbXAQ5+Rkdhn9VbopOqTXxU/8hjqxvazjrhiF3108a6ZzUY66cN777YadENHhpBOTsOIZg7L6 uc9jjn4w5jPXGhYQ9FXf6e+X2Cv1t4w==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1fQAML-00021i-Cl; Tue, 05 Jun 2018 11:42:41 +0000 Received: from ivanoab5.miniserver.com ([78.31.111.25] helo=www.kot-begemot.co.uk) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fQAMI-0001zd-MO for linux-um@lists.infradead.org; Tue, 05 Jun 2018 11:42:40 +0000 Received: from tun5.smaug.kot-begemot.co.uk ([192.168.18.6] helo=smaug.kot-begemot.co.uk) by www.kot-begemot.co.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1fQ7JZ-0002Nk-JU; Tue, 05 Jun 2018 08:27:37 +0000 Received: from wyvern.kot-begemot.co.uk ([192.168.3.72]) by smaug.kot-begemot.co.uk with esmtp (Exim 4.89) (envelope-from ) id 1fQ7JU-0005si-MD; Tue, 05 Jun 2018 09:27:32 +0100 From: anton.ivanov@cambridgegreys.com To: linux-um@lists.infradead.org Subject: [PATCH] Fix initialization of vector queues in UML Date: Tue, 5 Jun 2018 09:27:30 +0100 Message-Id: <20180605082730.30919-1-anton.ivanov@cambridgegreys.com> X-Mailer: git-send-email 2.11.0 X-Clacks-Overhead: GNU Terry Pratchett X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180605_044238_885274_BA4E9A08 X-CRM114-Status: UNSURE ( 8.86 ) X-CRM114-Notice: Please train this message. X-Spam-Score: 0.0 (/) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (0.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- X-BeenThere: linux-um@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: richard.weinberger@gmail.com, dan.carpenter@oracle.com, Anton Ivanov MIME-Version: 1.0 Sender: "linux-um" Errors-To: linux-um-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org From: Anton Ivanov UML vector drivers could derefence uninitialized memory when cleaning up after a queue allocation failure. Reported by Dan Capenter dan.carpenter@oracle.com Signed-off-by: Anton Ivanov --- arch/um/drivers/vector_kern.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c index 02168fe25105..8b852928959b 100644 --- a/arch/um/drivers/vector_kern.c +++ b/arch/um/drivers/vector_kern.c @@ -504,15 +504,19 @@ static struct vector_queue *create_queue( result = kmalloc(sizeof(struct vector_queue), GFP_KERNEL); if (result == NULL) - goto out_fail; + return NULL; result->max_depth = max_size; result->dev = vp->dev; result->mmsg_vector = kmalloc( (sizeof(struct mmsghdr) * max_size), GFP_KERNEL); + if (result->mmsg_vector == NULL) + goto out_mmsg_fail; result->skbuff_vector = kmalloc( (sizeof(void *) * max_size), GFP_KERNEL); - if (result->mmsg_vector == NULL || result->skbuff_vector == NULL) - goto out_fail; + if (result->skbuff_vector == NULL) + goto out_skb_fail; + + /* further failures can be handled safely by destroy_queue*/ mmsg_vector = result->mmsg_vector; for (i = 0; i < max_size; i++) { @@ -563,6 +567,11 @@ static struct vector_queue *create_queue( result->head = 0; result->tail = 0; return result; +out_skb_fail: + kfree(result->mmsg_vector); +out_mmsg_fail: + kfree(result); + return NULL; out_fail: destroy_queue(result); return NULL;