* [PATCH 1/4] drivers/char: Eliminate use after free
@ 2010-05-15 9:45 ` Julia Lawall
0 siblings, 0 replies; 9+ messages in thread
From: Julia Lawall @ 2010-05-15 9:45 UTC (permalink / raw)
To: Amit Shah, virtualization, linux-kernel, kernel-janitors
From: Julia Lawall <julia@diku.dk>
In each case, the first argument to send_control_msg or __send_control_msg,
respectively, has either not been successfully allocated or has been freed
at the point of the call. In the first case, the first argument, port, is
only used to access the portdev and id fields, in order to call
__send_control_msg. Thus it seems possible instead to call
__send_control_msg directly. In the second case, the call to
__send_control_msg is moved up to a place where it seems like the first
argument, portdev, has been initialized sufficiently to make the call to
__send_control_msg meaningful.
This has only been compile tested.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@free@
expression E;
position p;
@@
kfree@p(E)
@@
expression free.E, subE<=free.E, E1;
position free.p;
@@
kfree@p(E)
...
(
subE = E1
|
* E
)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
---
drivers/char/virtio_console.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 458d907..8c99bf1 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1090,7 +1090,7 @@ free_port:
kfree(port);
fail:
/* The host might want to notify management sw about port add failure */
- send_control_msg(port, VIRTIO_CONSOLE_PORT_READY, 0);
+ __send_control_msg(portdev, id, VIRTIO_CONSOLE_PORT_READY, 0);
return err;
}
@@ -1559,6 +1559,9 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
return 0;
free_vqs:
+ /* The host might want to notify mgmt sw about device add failure */
+ __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
+ VIRTIO_CONSOLE_DEVICE_READY, 0);
vdev->config->del_vqs(vdev);
kfree(portdev->in_vqs);
kfree(portdev->out_vqs);
@@ -1567,9 +1570,6 @@ free_chrdev:
free:
kfree(portdev);
fail:
- /* The host might want to notify mgmt sw about device add failure */
- __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
- VIRTIO_CONSOLE_DEVICE_READY, 0);
return err;
}
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 1/4] drivers/char: Eliminate use after free
@ 2010-05-15 9:45 ` Julia Lawall
0 siblings, 0 replies; 9+ messages in thread
From: Julia Lawall @ 2010-05-15 9:45 UTC (permalink / raw)
To: Amit Shah, virtualization, linux-kernel, kernel-janitors
From: Julia Lawall <julia@diku.dk>
In each case, the first argument to send_control_msg or __send_control_msg,
respectively, has either not been successfully allocated or has been freed
at the point of the call. In the first case, the first argument, port, is
only used to access the portdev and id fields, in order to call
__send_control_msg. Thus it seems possible instead to call
__send_control_msg directly. In the second case, the call to
__send_control_msg is moved up to a place where it seems like the first
argument, portdev, has been initialized sufficiently to make the call to
__send_control_msg meaningful.
This has only been compile tested.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@free@
expression E;
position p;
@@
kfree@p(E)
@@
expression free.E, subE<=free.E, E1;
position free.p;
@@
kfree@p(E)
...
(
subE = E1
|
* E
)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
---
drivers/char/virtio_console.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 458d907..8c99bf1 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1090,7 +1090,7 @@ free_port:
kfree(port);
fail:
/* The host might want to notify management sw about port add failure */
- send_control_msg(port, VIRTIO_CONSOLE_PORT_READY, 0);
+ __send_control_msg(portdev, id, VIRTIO_CONSOLE_PORT_READY, 0);
return err;
}
@@ -1559,6 +1559,9 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
return 0;
free_vqs:
+ /* The host might want to notify mgmt sw about device add failure */
+ __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
+ VIRTIO_CONSOLE_DEVICE_READY, 0);
vdev->config->del_vqs(vdev);
kfree(portdev->in_vqs);
kfree(portdev->out_vqs);
@@ -1567,9 +1570,6 @@ free_chrdev:
free:
kfree(portdev);
fail:
- /* The host might want to notify mgmt sw about device add failure */
- __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
- VIRTIO_CONSOLE_DEVICE_READY, 0);
return err;
}
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH 1/4] drivers/char: Eliminate use after free
2010-05-15 9:45 ` Julia Lawall
(?)
@ 2010-05-17 9:01 ` Amit Shah
-1 siblings, 0 replies; 9+ messages in thread
From: Amit Shah @ 2010-05-17 9:01 UTC (permalink / raw)
To: Julia Lawall; +Cc: kernel-janitors, linux-kernel, virtualization
On (Sat) May 15 2010 [11:45:53], Julia Lawall wrote:
> From: Julia Lawall <julia@diku.dk>
>
> In each case, the first argument to send_control_msg or __send_control_msg,
> respectively, has either not been successfully allocated or has been freed
> at the point of the call. In the first case, the first argument, port, is
> only used to access the portdev and id fields, in order to call
> __send_control_msg. Thus it seems possible instead to call
> __send_control_msg directly. In the second case, the call to
> __send_control_msg is moved up to a place where it seems like the first
> argument, portdev, has been initialized sufficiently to make the call to
> __send_control_msg meaningful.
>
> This has only been compile tested.
>
> A simplified version of the semantic match that finds this problem is as
> follows: (http://coccinelle.lip6.fr/)
>
> // <smpl>
> @free@
> expression E;
> position p;
> @@
> kfree@p(E)
>
> @@
> expression free.E, subE<=free.E, E1;
> position free.p;
> @@
>
> kfree@p(E)
> ...
> (
> subE = E1
> |
> * E
> )
> // </smpl>
>
> Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Amit Shah <amit.shah@redhat.com>
Thanks, Julia.
Rusty, please pick this patch. Thanks.
>
> ---
> drivers/char/virtio_console.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
> index 458d907..8c99bf1 100644
> --- a/drivers/char/virtio_console.c
> +++ b/drivers/char/virtio_console.c
> @@ -1090,7 +1090,7 @@ free_port:
> kfree(port);
> fail:
> /* The host might want to notify management sw about port add failure */
> - send_control_msg(port, VIRTIO_CONSOLE_PORT_READY, 0);
> + __send_control_msg(portdev, id, VIRTIO_CONSOLE_PORT_READY, 0);
> return err;
> }
>
> @@ -1559,6 +1559,9 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
> return 0;
>
> free_vqs:
> + /* The host might want to notify mgmt sw about device add failure */
> + __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
> + VIRTIO_CONSOLE_DEVICE_READY, 0);
> vdev->config->del_vqs(vdev);
> kfree(portdev->in_vqs);
> kfree(portdev->out_vqs);
> @@ -1567,9 +1570,6 @@ free_chrdev:
> free:
> kfree(portdev);
> fail:
> - /* The host might want to notify mgmt sw about device add failure */
> - __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
> - VIRTIO_CONSOLE_DEVICE_READY, 0);
> return err;
> }
>
Amit
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/4] drivers/char: Eliminate use after free
2010-05-15 9:45 ` Julia Lawall
@ 2010-05-17 9:13 ` Amit Shah
-1 siblings, 0 replies; 9+ messages in thread
From: Amit Shah @ 2010-05-17 9:01 UTC (permalink / raw)
To: Julia Lawall; +Cc: virtualization, linux-kernel, kernel-janitors, Rusty Russell
On (Sat) May 15 2010 [11:45:53], Julia Lawall wrote:
> From: Julia Lawall <julia@diku.dk>
>
> In each case, the first argument to send_control_msg or __send_control_msg,
> respectively, has either not been successfully allocated or has been freed
> at the point of the call. In the first case, the first argument, port, is
> only used to access the portdev and id fields, in order to call
> __send_control_msg. Thus it seems possible instead to call
> __send_control_msg directly. In the second case, the call to
> __send_control_msg is moved up to a place where it seems like the first
> argument, portdev, has been initialized sufficiently to make the call to
> __send_control_msg meaningful.
>
> This has only been compile tested.
>
> A simplified version of the semantic match that finds this problem is as
> follows: (http://coccinelle.lip6.fr/)
>
> // <smpl>
> @free@
> expression E;
> position p;
> @@
> kfree@p(E)
>
> @@
> expression free.E, subE<=free.E, E1;
> position free.p;
> @@
>
> kfree@p(E)
> ...
> (
> subE = E1
> |
> * E
> )
> // </smpl>
>
> Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Amit Shah <amit.shah@redhat.com>
Thanks, Julia.
Rusty, please pick this patch. Thanks.
>
> ---
> drivers/char/virtio_console.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
> index 458d907..8c99bf1 100644
> --- a/drivers/char/virtio_console.c
> +++ b/drivers/char/virtio_console.c
> @@ -1090,7 +1090,7 @@ free_port:
> kfree(port);
> fail:
> /* The host might want to notify management sw about port add failure */
> - send_control_msg(port, VIRTIO_CONSOLE_PORT_READY, 0);
> + __send_control_msg(portdev, id, VIRTIO_CONSOLE_PORT_READY, 0);
> return err;
> }
>
> @@ -1559,6 +1559,9 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
> return 0;
>
> free_vqs:
> + /* The host might want to notify mgmt sw about device add failure */
> + __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
> + VIRTIO_CONSOLE_DEVICE_READY, 0);
> vdev->config->del_vqs(vdev);
> kfree(portdev->in_vqs);
> kfree(portdev->out_vqs);
> @@ -1567,9 +1570,6 @@ free_chrdev:
> free:
> kfree(portdev);
> fail:
> - /* The host might want to notify mgmt sw about device add failure */
> - __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
> - VIRTIO_CONSOLE_DEVICE_READY, 0);
> return err;
> }
>
Amit
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/4] drivers/char: Eliminate use after free
@ 2010-05-17 9:13 ` Amit Shah
0 siblings, 0 replies; 9+ messages in thread
From: Amit Shah @ 2010-05-17 9:13 UTC (permalink / raw)
To: Julia Lawall; +Cc: virtualization, linux-kernel, kernel-janitors, Rusty Russell
On (Sat) May 15 2010 [11:45:53], Julia Lawall wrote:
> From: Julia Lawall <julia@diku.dk>
>
> In each case, the first argument to send_control_msg or __send_control_msg,
> respectively, has either not been successfully allocated or has been freed
> at the point of the call. In the first case, the first argument, port, is
> only used to access the portdev and id fields, in order to call
> __send_control_msg. Thus it seems possible instead to call
> __send_control_msg directly. In the second case, the call to
> __send_control_msg is moved up to a place where it seems like the first
> argument, portdev, has been initialized sufficiently to make the call to
> __send_control_msg meaningful.
>
> This has only been compile tested.
>
> A simplified version of the semantic match that finds this problem is as
> follows: (http://coccinelle.lip6.fr/)
>
> // <smpl>
> @free@
> expression E;
> position p;
> @@
> kfree@p(E)
>
> @@
> expression free.E, subE<=free.E, E1;
> position free.p;
> @@
>
> kfree@p(E)
> ...
> (
> subE = E1
> |
> * E
> )
> // </smpl>
>
> Signed-off-by: Julia Lawall <julia@diku.dk>
Acked-by: Amit Shah <amit.shah@redhat.com>
Thanks, Julia.
Rusty, please pick this patch. Thanks.
>
> ---
> drivers/char/virtio_console.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
> index 458d907..8c99bf1 100644
> --- a/drivers/char/virtio_console.c
> +++ b/drivers/char/virtio_console.c
> @@ -1090,7 +1090,7 @@ free_port:
> kfree(port);
> fail:
> /* The host might want to notify management sw about port add failure */
> - send_control_msg(port, VIRTIO_CONSOLE_PORT_READY, 0);
> + __send_control_msg(portdev, id, VIRTIO_CONSOLE_PORT_READY, 0);
> return err;
> }
>
> @@ -1559,6 +1559,9 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
> return 0;
>
> free_vqs:
> + /* The host might want to notify mgmt sw about device add failure */
> + __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
> + VIRTIO_CONSOLE_DEVICE_READY, 0);
> vdev->config->del_vqs(vdev);
> kfree(portdev->in_vqs);
> kfree(portdev->out_vqs);
> @@ -1567,9 +1570,6 @@ free_chrdev:
> free:
> kfree(portdev);
> fail:
> - /* The host might want to notify mgmt sw about device add failure */
> - __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
> - VIRTIO_CONSOLE_DEVICE_READY, 0);
> return err;
> }
>
Amit
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/4] drivers/char: Eliminate use after free
2010-05-17 9:13 ` Amit Shah
@ 2010-05-18 0:51 ` Rusty Russell
-1 siblings, 0 replies; 9+ messages in thread
From: Rusty Russell @ 2010-05-18 0:39 UTC (permalink / raw)
To: Amit Shah; +Cc: Julia Lawall, virtualization, linux-kernel, kernel-janitors
On Mon, 17 May 2010 06:31:40 pm Amit Shah wrote:
> On (Sat) May 15 2010 [11:45:53], Julia Lawall wrote:
> > From: Julia Lawall <julia@diku.dk>
...
> > Signed-off-by: Julia Lawall <julia@diku.dk>
>
> Acked-by: Amit Shah <amit.shah@redhat.com>
>
> Thanks, Julia.
>
> Rusty, please pick this patch. Thanks.
Done.
Thanks!
Rusty.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/4] drivers/char: Eliminate use after free
2010-05-17 9:13 ` Amit Shah
(?)
(?)
@ 2010-05-18 0:39 ` Rusty Russell
-1 siblings, 0 replies; 9+ messages in thread
From: Rusty Russell @ 2010-05-18 0:39 UTC (permalink / raw)
To: Amit Shah; +Cc: kernel-janitors, Julia Lawall, linux-kernel, virtualization
On Mon, 17 May 2010 06:31:40 pm Amit Shah wrote:
> On (Sat) May 15 2010 [11:45:53], Julia Lawall wrote:
> > From: Julia Lawall <julia@diku.dk>
...
> > Signed-off-by: Julia Lawall <julia@diku.dk>
>
> Acked-by: Amit Shah <amit.shah@redhat.com>
>
> Thanks, Julia.
>
> Rusty, please pick this patch. Thanks.
Done.
Thanks!
Rusty.
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH 1/4] drivers/char: Eliminate use after free
@ 2010-05-15 9:45 Julia Lawall
0 siblings, 0 replies; 9+ messages in thread
From: Julia Lawall @ 2010-05-15 9:45 UTC (permalink / raw)
To: Amit Shah, virtualization, linux-kernel, kernel-janitors
From: Julia Lawall <julia@diku.dk>
In each case, the first argument to send_control_msg or __send_control_msg,
respectively, has either not been successfully allocated or has been freed
at the point of the call. In the first case, the first argument, port, is
only used to access the portdev and id fields, in order to call
__send_control_msg. Thus it seems possible instead to call
__send_control_msg directly. In the second case, the call to
__send_control_msg is moved up to a place where it seems like the first
argument, portdev, has been initialized sufficiently to make the call to
__send_control_msg meaningful.
This has only been compile tested.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@free@
expression E;
position p;
@@
kfree@p(E)
@@
expression free.E, subE<=free.E, E1;
position free.p;
@@
kfree@p(E)
...
(
subE = E1
|
* E
)
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
---
drivers/char/virtio_console.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 458d907..8c99bf1 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1090,7 +1090,7 @@ free_port:
kfree(port);
fail:
/* The host might want to notify management sw about port add failure */
- send_control_msg(port, VIRTIO_CONSOLE_PORT_READY, 0);
+ __send_control_msg(portdev, id, VIRTIO_CONSOLE_PORT_READY, 0);
return err;
}
@@ -1559,6 +1559,9 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
return 0;
free_vqs:
+ /* The host might want to notify mgmt sw about device add failure */
+ __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
+ VIRTIO_CONSOLE_DEVICE_READY, 0);
vdev->config->del_vqs(vdev);
kfree(portdev->in_vqs);
kfree(portdev->out_vqs);
@@ -1567,9 +1570,6 @@ free_chrdev:
free:
kfree(portdev);
fail:
- /* The host might want to notify mgmt sw about device add failure */
- __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
- VIRTIO_CONSOLE_DEVICE_READY, 0);
return err;
}
^ permalink raw reply related [flat|nested] 9+ messages in thread
end of thread, other threads:[~2010-05-18 0:51 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-05-15 9:45 [PATCH 1/4] drivers/char: Eliminate use after free Julia Lawall
2010-05-15 9:45 ` Julia Lawall
2010-05-17 9:01 ` Amit Shah
2010-05-17 9:01 ` Amit Shah
2010-05-17 9:13 ` Amit Shah
2010-05-18 0:39 ` Rusty Russell
2010-05-18 0:51 ` Rusty Russell
2010-05-18 0:39 ` Rusty Russell
-- strict thread matches above, loose matches on Subject: below --
2010-05-15 9:45 Julia Lawall
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.