[lkml]   [2020]   [Jan]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] fs: pstore: fix double-free on ramoops_init_przs
Hello Kees!

It's a pleasure to hear from you!

On 2020-01-07 21:05, Kees Cook wrote:
> I think this is a false positive (have you actually hit the
> double-free?). The logic in this area is:

No I did not actually hit the double-free. I'm just following
the indicators from static analyzer.

> nothing was freeing the label on the failed prz, but all the other prz
> labels were free (i.e. there is a "i--" that skips the failed prz
> alloc).

I have noticed that. Thanks for clearing it up though.

The `kfree` I was referring to is in `err:` label of function
`persistent_ram_new` in `ram_core.c#595` of `for-next/pstore` tree:

Here are the relevant bits:

struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t
u32 sig, struct persistent_ram_ecc_info *ecc_info,
unsigned int memtype, u32 flags, char *label)
/* ... */
/* ... */
/* ... */
return prz;
persistent_ram_free(prz); /* <----- */
return ERR_PTR(ret);

So, to my understanding, if our `persistent_ram_new` call in `ram.c#583`
fails, it already does clean up the `label` pointer in itself and
an ERR_PTR back to us and our skipping logic does its job.

I might be missing something but it seems so.

Thank you for looking into this.

Cengiz Can

 \ /
  Last update: 2020-01-07 20:42    [W:0.060 / U:5.716 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site