lkml.org 
[lkml]   [2019]   [May]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [PATCH] vt: Fix a missing-check bug in drivers/tty/vt/vt.c file of Linux 5.0.14
    On Sun, May 12, 2019 at 08:20:09AM +0200, Greg KH wrote:
    > Yes, that worked! Now, can you resend it in a proper format that I can
    > apply it in? (with changelog text, signed-off-by, etc.) as described in
    > Documentation/SubmittingPatches, I will be glad to review it after the
    > 5.2-rc1 release happens.
    >
    > thanks,
    >
    > greg k-h
    From: Gen Zhang <blackgod016574@gmail.com>
    Date: Sun, 11 May 2019 15:31:30 +0000
    Subject: [PATCH] vt: Fix a missing-check bug in drivers/tty/vt/vt.c file of Linux 5.0.14

    Hi,
    I found this missing-check bug in drivers/tty/vt/vt.c when I was examining the source code.

    In function con_init(), the pointer variable vc_cons[currcons].d, vc and vc->vc_screenbuf is allocated a memory space via kzalloc().
    And they are used in the following codes.

    However, when there is a memory allocation error, kzalloc can be failed.
    Thus null pointer (vc_cons[currcons].d, vc and vc->vc_screenbuf) dereference may happen.
    And it will cause the kernel to crash. Therefore, we should check return value and handle an error.

    And this patch works in 5.1.1.

    Thank you!

    Kind regards
    Gen

    Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
    ---
    --- drivers/tty/vt/vt.c
    +++ drivers/tty/vt/vt.c
    @@ -3349,10 +3349,14 @@ static int __init con_init(void)

    for (currcons = 0; currcons < MIN_NR_CONSOLES; currcons++) {
    vc_cons[currcons].d = vc = kzalloc(sizeof(struct vc_data), GFP_NOWAIT);
    + if (!vc_cons[currcons].d || !vc)
    + goto err_vc;
    INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
    tty_port_init(&vc->port);
    visual_init(vc, currcons, 1);
    vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);
    + if (!vc->vc_screenbuf)
    + goto err_vc_screenbuf;
    vc_init(vc, vc->vc_rows, vc->vc_cols,
    currcons || !vc->vc_sw->con_save_screen);
    }
    @@ -3374,6 +3378,14 @@ static int __init con_init(void)
    register_console(&vt_console_driver);
    #endif
    return 0;
    +err_vc:
    + console_unlock();
    + return -ENOMEM;
    +err_vc_screenbuf:
    + console_unlock();
    + kfree(vc);
    + vc_cons[currcons].d = NULL;
    + return -ENOMEM;
    }
    console_initcall(con_init);

    ---
    \
     
     \ /
      Last update: 2019-05-12 10:50    [W:5.186 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site