Messages in this thread | | | Date | Mon, 15 Jan 2024 12:05:22 +0100 | Subject | Re: [PATCH v2] cxl: Fix null pointer dereference in cxl_get_fd | From | Frederic Barrat <> |
| |
On 12/01/2024 06:49, Kunwu Chan wrote: > kasprintf() returns a pointer to dynamically allocated memory > which can be NULL upon failure. > > Uniformly handle resource release in error paths. And when an > error occurs, an error pointer should be returned. > > Fixes: bdecf76e319a ("cxl: Fix coredump generation when cxl_get_fd() is used") > Signed-off-by: Kunwu Chan <chentao@kylinos.cn> > Cc: Kunwu Chan <kunwu.chan@hotmail.com> > Suggested-by: Frederic Barrat <fbarrat@linux.ibm.com> > ---
Thanks! Acked-by: Frederic Barrat <fbarrat@linux.ibm.com>
Fred
> v2: Deal with error path > --- > drivers/misc/cxl/api.c | 18 ++++++++++++++---- > 1 file changed, 14 insertions(+), 4 deletions(-) > > diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c > index d85c56530863..b49bc3d29fc0 100644 > --- a/drivers/misc/cxl/api.c > +++ b/drivers/misc/cxl/api.c > @@ -389,19 +389,22 @@ struct file *cxl_get_fd(struct cxl_context *ctx, struct file_operations *fops, > int *fd) > { > struct file *file; > - int rc, flags, fdtmp; > + int rc = 0, flags, fdtmp; > char *name = NULL; > > /* only allow one per context */ > - if (ctx->mapping) > - return ERR_PTR(-EEXIST); > + if (ctx->mapping) { > + rc = -EEXIST; > + goto err; > + } > > flags = O_RDWR | O_CLOEXEC; > > /* This code is similar to anon_inode_getfd() */ > rc = get_unused_fd_flags(flags); > if (rc < 0) > - return ERR_PTR(rc); > + goto err; > + > fdtmp = rc; > > /* > @@ -419,6 +422,10 @@ struct file *cxl_get_fd(struct cxl_context *ctx, struct file_operations *fops, > fops = (struct file_operations *)&afu_fops; > > name = kasprintf(GFP_KERNEL, "cxl:%d", ctx->pe); > + if (!name) { > + rc = -ENOMEM; > + goto err_fd; > + } > file = cxl_getfile(name, fops, ctx, flags); > kfree(name); > if (IS_ERR(file)) > @@ -430,6 +437,9 @@ struct file *cxl_get_fd(struct cxl_context *ctx, struct file_operations *fops, > > err_fd: > put_unused_fd(fdtmp); > +err: > + if (rc < 0) > + return ERR_PTR(rc); > return NULL; > } > EXPORT_SYMBOL_GPL(cxl_get_fd);
| |