Messages in this thread |  | | From | Dawson Engler <> | Subject | [CHECKER] free bugs in 2.4.4 and 2.4.4-ac8 | Date | Thu, 24 May 2001 14:04:02 -0700 (PDT) |
| |
Hi All,
Enclosed are 24 bugs where code uses memory that has been freed. The good thing about these bugs is that they are easy to fix. (Note: About 5 of these have had patches submitted, so this list is a bit out of date.)
Summary 2.4.4ac8-specific errors = 4 2.4.4-specific errors = 5 Common errors = 15 Total = 24
Dawson
# BUGs | File Name 3 | drivers/char/rio/rio_linux.c 3 | drivers/atm/iphase.c 2 | drivers/usb/dc2xx.c 2 | drivers/block/cciss.c 1 | drivers/char/drm/gamma_dma.c 1 | fs/proc/generic.c 1 | drivers/isdn/isdn_ppp.c 1 | net/ax25/ax25_ip.c 1 | drivers/net/wan/lapbether.c 1 | drivers/usb/serial/io_edgeport.c 1 | net/netrom/nr_dev.c 1 | drivers/i2o/i2o_pci.c 1 | drivers/sound/cs4281/cs4281m.c 1 | drivers/net/hamradio/bpqether.c 1 | net/ipv6/udp.c 1 | net/wanrouter/wanmain.c 1 | drivers/net/irda/nsc-ircc.c 1 | drivers/sound/cs46xx.c
----------------------------------------------------------------------
Boilerplate disclaimer: - this is part of a one-time large batch of errors. In the future, we'll send out incremental bug reports along with a pointer to the bug database on our website.
- as always, bugs may not be errors --- we have inspected the error logs to counter this.
- bugs may be missing in one distribution versus the other because we did not compile that file (or failed to fully compile it). It can be worthwhile to cross check important bugs to make sure they've been killed.
- sorted roughly by severity and ease-of-diagnosis. The highest ranked bugs are "SECURITY" which (in most of the examples) are primarily denial-of-service vulnerabilities where the user could trigger the bug when they canted to. Ease-of-diagnosis is currently crude: we rank LOCAL errors over GLOBAL (GLOBAL require looking at call chains) and then distance between error source and manifestation as the next (closer is better)
- if a version if one of the version has no errors specific to it, this can just be because we did not inspect all the error reports. These are typically from checkers that required some inter-function inspection. If you are interested in these errors, send us mail,, and we can send you the unispected file.
############################################################ # 2.4.4ac8 specific errors # --------------------------------------------------------- [BUG] [fixed in 2.4.4] /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/block/cciss.c:686:cciss_ioctl: ERROR:FREE:682:686: WARN: Use-after-free of "c"! set by 'cmd_free':682 [type=SECURITY] { /* Copy the data out of the buffer we created */ if (copy_to_user(iocommand.buf, buff, iocommand.buf_size)) { kfree(buff); Start ---> cmd_free(h, c, 0); } } kfree(buff); Error ---> cmd_free(h, c, 0); return(0); }
--------------------------------------------------------- [BUG] [fixed in 2.4.4] /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/block/cciss.c:685:cciss_ioctl: ERROR:FREE:681:685: WARN: Use-after-free of "buff"! set by 'kfree':681 [type=SECURITY] if (iocommand.Request.Type.Direction == XFER_READ) { /* Copy the data out of the buffer we created */ if (copy_to_user(iocommand.buf, buff, iocommand.buf_size)) { Start ---> kfree(buff); cmd_free(h, c, 0); } } Error ---> kfree(buff); cmd_free(h, c, 0); return(0); } --------------------------------------------------------- [BUG] Looks pretty bad /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/usb/dc2xx.c:473:camera_disconnect: ERROR:FREE:466:473: WARN: Use-after-free of "camera"! set by 'kfree':466 /* If camera's not opened, we can clean up right away. * Else apps see a disconnect on next I/O; the release cleans. */ if (!camera->buf) { minor_data [subminor] = NULL; Start ---> kfree (camera); } else camera->dev = NULL;
info ("USB Camera #%d disconnected", subminor); usb_dec_dev_use (dev);
Error ---> up (&camera->sem); up (&state_table_mutex); }
--------------------------------------------------------- [BUG] seems possible --- or is some precondition guarenteed? /u2/engler/mc/oses/linux/2.4.4-ac8/net/ipv6/udp.c:438:udpv6_recvmsg: ERROR:FREE:453:438: WARN: Use-after-free of "skb"! set by 'kfree_skb':453 } } err = copied;
out_free: Error ---> skb_free_datagram(sk, skb);
... DELETED 9 lines ...
__skb_unlink(skb, &sk->receive_queue); clear = 1; } spin_unlock_irq(&sk->receive_queue.lock); if (clear) Start ---> kfree_skb(skb); }
/* Error for blocking case is chosen to masquerade
############################################################ # 2.4.4 specific errors
# --------------------------------------------------------- [BUG] [fixed in ac8] /u2/engler/mc/oses/linux/2.4.4/drivers/net/irda/nsc-ircc.c:319:nsc_ircc_open: ERROR:FREE:318:319: WARN: Use-after-free of "self"! set by 'kfree':318 memset(self->rx_buff.head, 0, self->rx_buff.truesize); self->tx_buff.head = (__u8 *) kmalloc(self->tx_buff.truesize, GFP_KERNEL|GFP_DMA); if (self->tx_buff.head == NULL) { Start ---> kfree(self); Error ---> kfree(self->rx_buff.head); return -ENOMEM; } memset(self->tx_buff.head, 0, self->tx_buff.truesize); --------------------------------------------------------- [BUG] BAD /u2/engler/mc/oses/linux/2.4.4/drivers/sound/cs46xx.c:5324:cs46xx_remove: ERROR:FREE:5322:5324: WARN: Use-after-free of "card"! set by 'kfree':5322 kfree (card->ac97_codec[i]); } unregister_sound_dsp(card->dev_audio); if(card->dev_midi) unregister_sound_midi(card->dev_midi); Start ---> kfree(card); PCI_SET_DRIVER_DATA(pci_dev,NULL); Error ---> list_del(&card->list);
CS_DBGOUT(CS_INIT | CS_FUNCTION, 2, printk(KERN_INFO "cs46xx: cs46xx_remove()-: remove successful\n")); --------------------------------------------------------- [BUG] [BAD] Seems like a really really bad double free. /u2/engler/mc/oses/linux/2.4.4/drivers/i2o/i2o_pci.c:231:i2o_pci_install: ERROR:FREE:229:231: WARN: Use-after-free of "c"! set by 'i2o_delete_controller':229 c->name, dev->irq); c->bus.pci.irq = -1; #ifdef MODULE core->delete(c); #else Start ---> i2o_delete_controller(c); #endif /* MODULE */ Error ---> kfree(c); iounmap(mem); return -EBUSY; } --------------------------------------------------------- [BUG] [BAD] Returns a freed pointer -- very very bad. /u2/engler/mc/oses/linux/2.4.4/fs/proc/generic.c:438:proc_symlink: ERROR:FREE:430:438: WARN: Use-after-free of "ent"! set by 'kfree':430 ent->namelen = len; ent->nlink = 1; ent->mode = S_IFLNK|S_IRUGO|S_IWUGO|S_IXUGO; ent->data = kmalloc((ent->size=strlen(dest))+1, GFP_KERNEL); if (!ent->data) { Start ---> kfree(ent); goto out; } strcpy((char*)ent->data,dest);
proc_register(parent, ent); out: Error ---> return ent; }
struct proc_dir_entry *proc_mknod(const char *name, mode_t mode,
############################################################ # errors common to both
# --------------------------------------------------------- [BUG] [GEM] horrible horrible bug. /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/isdn/isdn_ppp.c:822:isdn_ppp_init: ERROR:FREE:822:822: WARN: Use-after-free of "ippp_table"! set by 'kfree':822 for (i = 0; i < ISDN_MAX_CHANNELS; i++) { if (!(ippp_table[i] = (struct ippp_struct *) kmalloc(sizeof(struct ippp_struct), GFP_KERNEL))) { printk(KERN_WARNING "isdn_ppp_init: Could not alloc ippp_table\n"); for (j = 0; j < i; j++)
Error ---> kfree(ippp_table[i]); --------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/atm/iphase.c:1323:rx_dle_intr: ERROR:FREE:1321:1323: WARN: Use-after-free of "skb"! set by 'dev_kfree_skb_any':1321 } ia_vcc = INPH_IA_VCC(vcc); if (ia_vcc == NULL) { atomic_inc(&vcc->stats->rx_err); Start ---> dev_kfree_skb_any(skb); #if LINUX_VERSION_CODE >= 0x20312 Error ---> atm_return(vcc, atm_guess_pdu2truesize(skb->len)); #else atm_return(vcc, atm_pdu2truesize(skb->len)); #endif --------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/atm/iphase.c:1339:rx_dle_intr: ERROR:FREE:1337:1339: WARN: Use-after-free of "skb"! set by 'dev_kfree_skb_any':1337 length = swap(trailer->length); if ((length > iadev->rx_buf_sz) || (length > (skb->len - sizeof(struct cpcs_trailer)))) { atomic_inc(&vcc->stats->rx_err); Start ---> dev_kfree_skb_any(skb); IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)", Error ---> length, skb->len);) #if LINUX_VERSION_CODE >= 0x20312 atm_return(vcc, atm_guess_pdu2truesize(skb->len)); #else --------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/sound/cs4281/cs4281m.c:4468:cs4281_remove: ERROR:FREE:4466:4468: WARN: Use-after-free of "s"! set by 'kfree':4466 unregister_sound_dsp(s->dev_audio); unregister_sound_mixer(s->dev_mixer); unregister_sound_midi(s->dev_midi); iounmap(s->pBA1); iounmap(s->pBA0); Start ---> kfree(s); pci_set_drvdata(pci_dev,NULL); Error ---> list_del(&s->list); CS_DBGOUT(CS_INIT | CS_FUNCTION, 2, printk(KERN_INFO "cs4281: cs4281_remove()-: remove successful\n")); } --------------------------------------------------------- [BUG] Again assumes kfree sets memory to NULL. /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/net/wan/lapbether.c:116:lapbeth_check_devices: ERROR:FREE:113:116: WARN: Use-after-free of "lapbeth"! set by 'kfree':113 if (&lapbeth->axdev == dev) result = 1;
unregister_netdev(&lapbeth->axdev); dev_put(lapbeth->ethdev); Start ---> kfree(lapbeth); }
Error ---> lapbeth_prev = lapbeth; }
restore_flags(flags); --------------------------------------------------------- [BUG] bpq is freed, assigned to another variable (bpq_prev), then /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/net/hamradio/bpqether.c:196:bpq_check_devices: ERROR:FREE:193:196: WARN: Use-after-free of "bpq"! set by 'kfree':193 /* We should be locked, call * unregister_netdevice directly */
unregister_netdevice(&bpq->axdev); Start ---> kfree(bpq); }
Error ---> bpq_prev = bpq; }
restore_flags(flags); --------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/net/wanrouter/wanmain.c:617:device_setup: ERROR:FREE:614:617: WARN: Use-after-free of "conf"! set by 'kfree':614 return -EINVAL; }
if (conf->data_size && conf->data){ if(conf->data_size > 128000 || conf->data_size < 0) { Start ---> kfree(conf); printk(KERN_INFO "%s: ERROR, Invalid firmware data size %i !\n", Error ---> wandev->name, conf->data_size); return -EINVAL;; }
--------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/atm/iphase.c:1341:rx_dle_intr: ERROR:FREE:1337:1341: WARN: Use-after-free of "skb"! set by 'dev_kfree_skb_any':1337 length = swap(trailer->length); if ((length > iadev->rx_buf_sz) || (length > (skb->len - sizeof(struct cpcs_trailer)))) { atomic_inc(&vcc->stats->rx_err); Start ---> dev_kfree_skb_any(skb); IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)", length, skb->len);) #if LINUX_VERSION_CODE >= 0x20312 Error ---> atm_return(vcc, atm_guess_pdu2truesize(skb->len)); #else atm_return(vcc, atm_pdu2truesize(skb->len)); #endif --------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/net/netrom/nr_dev.c:122:nr_rebuild_header: ERROR:FREE:117:122: WARN: Use-after-free of "skbn"! set by 'kfree_skb':117 skb_set_owner_w(skbn, skb->sk);
kfree_skb(skb);
if (!nr_route_frame(skbn, NULL)) { Start ---> kfree_skb(skbn); stats->tx_errors++; }
stats->tx_packets++; Error ---> stats->tx_bytes += skbn->len;
return 1; } --------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/net/ax25/ax25_ip.c:163:ax25_rebuild_header: ERROR:FREE:157:163: WARN: Use-after-free of "skb"! set by 'kfree_skb':157 }
if (skb->sk != NULL) skb_set_owner_w(ourskb, skb->sk);
Start ---> kfree_skb(skb);
src_c = *src; dst_c = *dst;
skb_pull(ourskb, AX25_HEADER_LEN - 1); /* Keep PID */ Error ---> skb->nh.raw = skb->data;
ax25_send_frame(ourskb, ax25_dev->values[AX25_VALUES_PACLEN], &src_c, &dst_c, route->digipeat, dev); --------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/usb/serial/io_edgeport.c:944:edge_bulk_out_cmd_callback: ERROR:FREE:937:944: WARN: Use-after-free of "urb"! set by 'usb_free_urb':937 kfree(urb->transfer_buffer); }
// Free the command urb usb_unlink_urb (urb); Start ---> usb_free_urb (urb);
if (port_paranoia_check (edge_port->port, __FUNCTION__)) { return; }
if (status) { Error ---> dbg(__FUNCTION__" - nonzero write bulk status received: %d", urb->status); return; }
--------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/char/drm/gamma_dma.c:573:gamma_dma_send_buffers: ERROR:FREE:561:573: WARN: Use-after-free of "last_buf"! set by 'drm_free_buffer':561 DRM_DEBUG("%d running\n", current->pid); remove_wait_queue(&last_buf->dma_wait, &entry); if (!retcode || (last_buf->list==DRM_LIST_PEND && !last_buf->pending)) { if (!waitqueue_active(&last_buf->dma_wait)) { Start ---> drm_free_buffer(dev, last_buf); } } if (retcode) { DRM_ERROR("ctx%d w%d p%d c%d i%d l%d %d/%d\n", d->context, last_buf->waiting, last_buf->pending, DRM_WAITCOUNT(dev, d->context), last_buf->idx, last_buf->list, last_buf->pid, Error ---> current->pid); } } return retcode;
--------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/usb/dc2xx.c:332:camera_release: ERROR:FREE:330:332: WARN: Use-after-free of "camera"! set by 'kfree':330 subminor = camera->subminor;
/* If camera was unplugged with open file ... */ if (!camera->dev) { minor_data [subminor] = NULL; Start ---> kfree (camera); } Error ---> up (&camera->sem); up (&state_table_mutex);
dbg ("close #%d", subminor); --------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/char/rio/rio_linux.c:1036:rio_init_datastructures: ERROR:FREE:1031:1036: WARN: Use-after-free of "RIOHosts"! set by 'kfree':1031 kfree (p->RIOPortp[i]); /*free5: */ kfree (rio_termios_locked); free4:kfree (rio_termios); free3:kfree (p->RIOPortp); Start ---> free2:kfree (p->RIOHosts); free1:kfree (p); free0: if (p) { rio_dprintk (RIO_DEBUG_INIT, "Not enough memory! %p %p %p %p %p\n", Error ---> p, p->RIOHosts, p->RIOPortp, rio_termios, rio_termios); } return -ENOMEM; } --------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.4-ac8/drivers/char/rio/rio_linux.c:1036:rio_init_datastructures: ERROR:FREE:1030:1036: WARN: Use-after-free of "RIOPortp"! set by 'kfree':1030 free6:for (i--;i>=0;i--) kfree (p->RIOPortp[i]); /*free5: */ kfree (rio_termios_locked); free4:kfree (rio_termios); Start ---> free3:kfree (p->RIOPortp); free2:kfree (p->RIOHosts); free1:kfree (p); free0: if (p) { rio_dprintk (RIO_DEBUG_INIT, "Not enough memory! %p %p %p %p %p\n", Error ---> p, p->RIOHosts, p->RIOPortp, rio_termios, rio_termios); } return -ENOMEM; }
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |