* Fwd: Possible null pointer dereference in con_init() [not found] <CAFSR4cs_pVwH1Tcf4-pyKr3-TPtvS34Av-2jGA7L4MmTX-_4rw@mail.gmail.com> @ 2020-05-03 7:20 ` Dongyang Zhan 2020-05-03 7:44 ` Greg KH 0 siblings, 1 reply; 2+ messages in thread From: Dongyang Zhan @ 2020-05-03 7:20 UTC (permalink / raw) To: linux-serial Hi, I am a security researcher, my name is Dongyang Zhan. I found a potential bug. I hope you can help me to confirm it. Thank you. In Linux 4.10.17, function con_init() in /drivers/tty/vt/vt.c forgets to handle the failure of the memory allocation operation (e.g., vc_cons[currcons].d = vc = kzalloc(sizeof(struct vc_data), GFP_NOWAIT)). Source code and comments； vc_cons[currcons].d = vc = kzalloc(sizeof(struct vc_data), GFP_NOWAIT); INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK); tty_port_init(&vc->port); visual_init(vc, currcons, 1); vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT); vc_init(vc, vc->vc_rows, vc->vc_cols, currcons || !vc->vc_sw->con_save_screen); If the allocation fails, dereferencing vc will cause a null pointer dereference. ^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Fwd: Possible null pointer dereference in con_init() 2020-05-03 7:20 ` Fwd: Possible null pointer dereference in con_init() Dongyang Zhan @ 2020-05-03 7:44 ` Greg KH 0 siblings, 0 replies; 2+ messages in thread From: Greg KH @ 2020-05-03 7:44 UTC (permalink / raw) To: Dongyang Zhan; +Cc: linux-serial On Sun, May 03, 2020 at 03:20:50PM +0800, Dongyang Zhan wrote: > Hi, > > I am a security researcher, my name is Dongyang Zhan. I found a potential bug. > > I hope you can help me to confirm it. > > Thank you. > > In Linux 4.10.17, function con_init() in /drivers/tty/vt/vt.c forgets > to handle the failure of the memory allocation operation (e.g., > vc_cons[currcons].d = vc = kzalloc(sizeof(struct vc_data), > GFP_NOWAIT)). > > Source code and comments； > vc_cons[currcons].d = vc = kzalloc(sizeof(struct vc_data), GFP_NOWAIT); > INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK); > tty_port_init(&vc->port); > visual_init(vc, currcons, 1); > vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT); > vc_init(vc, vc->vc_rows, vc->vc_cols, > currcons || !vc->vc_sw->con_save_screen); > > If the allocation fails, dereferencing vc will cause a null pointer dereference. But that allocation can not fail, so all is fine. thanks, greg k-h ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-05-03 7:44 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <CAFSR4cs_pVwH1Tcf4-pyKr3-TPtvS34Av-2jGA7L4MmTX-_4rw@mail.gmail.com>
2020-05-03 7:20 ` Fwd: Possible null pointer dereference in con_init() Dongyang Zhan
2020-05-03 7:44 ` Greg KH
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.