Messages in this thread | | | Subject | [RESEND] Unsafe kmalloc() calls found | From | Oliver Henning <> | Date | Thu, 4 Apr 2019 16:09:55 +0200 |
| |
Hello
I have written a Python script to scan the kernel for unchecked kmalloc() calls. It found the following instances. I checked them manually, too. I would like to fix them myself but I do not how to do a proper failure handling. So maybe someone else can have a look.
Oliver
drivers/net/wireless/rsi/rsi_91x_mac80211.c:199 channels = kmalloc(sizeof(rsi_2ghz_channels), GFP_KERNEL); memcpy(channels, rsi_2ghz_channels, sizeof(rsi_2ghz_channels)); ---
drivers/net/wireless/rsi/rsi_91x_mac80211.c:208 channels = kmalloc(sizeof(rsi_5ghz_channels), GFP_KERNEL); memcpy(channels, rsi_5ghz_channels, sizeof(rsi_5ghz_channels)); ---
arch/mips/pmcs-msp71xx/msp_prom.c:378 argv = kmalloc(len, GFP_KERNEL); ptr = (char *) &argv[prom_argc + 1]; /* strings follow array */ for (argc = 0; argc < prom_argc; argc++) { argv[argc] = ptr; strcpy(ptr, prom_argv[argc]); ptr += strlen(prom_argv[argc]) + 1; } ---
arch/mips/pmcs-msp71xx/msp_prom.c:399 envp = kmalloc(len, GFP_KERNEL); ptr = (char *) &envp[i+1]; for (argc = 0; argc < i; argc++) { envp[argc] = ptr; strcpy(ptr, prom_envp[argc]); ptr += strlen(prom_envp[argc]) + 1; } ---
arch/powerpc/platforms/pseries/dlpar.c:389 hp_errlog_copy = kmalloc(sizeof(struct pseries_hp_errorlog), GFP_KERNEL); memcpy(hp_errlog_copy, hp_errlog, sizeof(struct pseries_hp_errorlog)); ---
drivers/media/pci/cx23885/cx23885-dvb.c:1477 fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL); memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops)); ---
drivers/misc/lkdtm/perms.c:135 u32 *kmalloc_area = kmalloc(EXEC_SIZE, GFP_KERNEL); execute_location(kmalloc_area, CODE_WRITE); kfree(kmalloc_area); } ---
drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c:113 new_compat = kmalloc(new_len, GFP_KERNEL); omapdss_prefix_strcpy(new_compat, new_len, prop->value, prop->length); omapdss_update_prop(node, new_compat, new_len); } ---
drivers/staging/media/davinci_vpfe/dm365_ipipe.c:1267 params = kmalloc(sizeof(struct ipipe_module_params), GFP_KERNEL); to = (void *)params + module_if->param_offset; size = module_if->param_size; if (to && from && size) { if (copy_from_user(to, (void __user *)from, size)) { rval = -EFAULT; break; } ---
drivers/staging/media/davinci_vpfe/dm365_ipipe.c:1309 params = kmalloc(sizeof(struct ipipe_module_params), GFP_KERNEL); from = (void *)params + module_if->param_offset; size = module_if->param_size; if (to && from && size) { rval = module_if->get(ipipe, from); if (rval) goto error; if (copy_to_user((void __user *)to, from, size)) { ---
| |