From: lixiaokeng <lixiaokeng@huawei.com>
To: Martin Wilck <mwilck@suse.com>,
Benjamin Marzinski <bmarzins@redhat.com>,
Christophe Varoqui <christophe.varoqui@opensvc.com>,
dm-devel mailing list <dm-devel@redhat.com>
Cc: linfeilong <linfeilong@huawei.com>,
"liuzhiqiang (I)" <liuzhiqiang26@huawei.com>
Subject: [PATCH V6 11/14] mpathpersist: check whether malloc paramp->trnptid_list fails in handle_args func
Date: Sat, 19 Sep 2020 18:28:36 +0800 [thread overview]
Message-ID: <39c4b48b-4cc8-062e-c6c8-1207b38f576a@huawei.com> (raw)
In-Reply-To: <ae709d8f-64f7-30bc-bd08-fc2398c0c093@huawei.com>
In handle_args func, we donot check whether malloc paramp and
each paramp->trnptid_list[j] fails before using them, it may
cause access NULL pointer.
Here, we add alloc_prout_param_descriptor to allocate and init
paramp, and we add free_prout_param_descriptor to free paramp
and each paramp->trnptid_list[j].
We change num_transport to num_transportids to combine them.
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Signed-off-by: lixiaokeng <lixiaokeng@huawei.com>
---
mpathpersist/main.c | 64 ++++++++++++++++++++++++++++++++++-----------
1 file changed, 49 insertions(+), 15 deletions(-)
diff --git a/mpathpersist/main.c b/mpathpersist/main.c
index 28bfe410..f6a8b38c 100644
--- a/mpathpersist/main.c
+++ b/mpathpersist/main.c
@@ -153,6 +153,37 @@ static int do_batch_file(const char *batch_fn)
return ret;
}
+static struct prout_param_descriptor *
+alloc_prout_param_descriptor(int num_transportid)
+{
+ struct prout_param_descriptor *paramp;
+
+ if (num_transportid < 0 || num_transportid > MPATH_MX_TIDS)
+ return NULL;
+
+ paramp= malloc(sizeof(struct prout_param_descriptor) +
+ (sizeof(struct transportid *) * num_transportid));
+
+ if (!paramp)
+ return NULL;
+
+ memset(paramp, 0, sizeof(struct prout_param_descriptor) +
+ (sizeof(struct transportid *) * num_transportid));
+ return paramp;
+}
+
+static void free_prout_param_descriptor(struct prout_param_descriptor *paramp)
+{
+ unsigned int i;
+ if (!paramp)
+ return;
+
+ for (i = 0; i < paramp->num_transportid; i++)
+ free(paramp->trnptid_list[i]);
+
+ free(paramp);
+}
+
static int handle_args(int argc, char * argv[], int nline)
{
int c;
@@ -177,7 +208,6 @@ static int handle_args(int argc, char * argv[], int nline)
int prin = 1;
int prin_sa = -1;
int prout_sa = -1;
- int num_transport =0;
char *batch_fn = NULL;
void *resp = NULL;
struct transportid * tmp;
@@ -334,13 +364,13 @@ static int handle_args(int argc, char * argv[], int nline)
break;
case 'X':
- if (0 != construct_transportid(optarg, transportids, num_transport)) {
+ if (0 != construct_transportid(optarg, transportids, num_transportids)) {
fprintf(stderr, "bad argument to '--transport-id'\n");
ret = MPATH_PR_SYNTAX_ERROR;
goto out;
}
- ++num_transport;
+ ++num_transportids;
break;
case 'l':
@@ -525,9 +555,12 @@ static int handle_args(int argc, char * argv[], int nline)
int j;
struct prout_param_descriptor *paramp;
- paramp= malloc(sizeof(struct prout_param_descriptor) + (sizeof(struct transportid *)*(MPATH_MX_TIDS )));
-
- memset(paramp, 0, sizeof(struct prout_param_descriptor) + (sizeof(struct transportid *)*(MPATH_MX_TIDS)));
+ paramp = alloc_prout_param_descriptor(num_transportids);
+ if (!paramp) {
+ fprintf(stderr, "malloc paramp failed\n");
+ ret = MPATH_PR_OTHER;
+ goto out_fd;
+ }
for (j = 7; j >= 0; --j) {
paramp->key[j] = (param_rk & 0xff);
@@ -544,13 +577,19 @@ static int handle_args(int argc, char * argv[], int nline)
if (param_aptpl)
paramp->sa_flags |= MPATH_F_APTPL_MASK;
- if (num_transport)
+ if (num_transportids)
{
paramp->sa_flags |= MPATH_F_SPEC_I_PT_MASK;
- paramp->num_transportid = num_transport;
- for (j = 0 ; j < num_transport; j++)
+ paramp->num_transportid = num_transportids;
+ for (j = 0 ; j < num_transportids; j++)
{
paramp->trnptid_list[j] = (struct transportid *)malloc(sizeof(struct transportid));
+ if (!paramp->trnptid_list[j]) {
+ fprintf(stderr, "malloc paramp->trnptid_list[%d] failed.\n", j);
+ ret = MPATH_PR_OTHER;
+ free_prout_param_descriptor(paramp);
+ goto out_fd;
+ }
memcpy(paramp->trnptid_list[j], &transportids[j],sizeof(struct transportid));
}
}
@@ -558,12 +597,7 @@ static int handle_args(int argc, char * argv[], int nline)
/* PROUT commands other than 'register and move' */
ret = __mpath_persistent_reserve_out (fd, prout_sa, 0, prout_type,
paramp, noisy);
- for (j = 0 ; j < num_transport; j++)
- {
- tmp = paramp->trnptid_list[j];
- free(tmp);
- }
- free(paramp);
+ free_prout_param_descriptor(paramp);
}
if (ret != MPATH_PR_SUCCESS)
--
next prev parent reply other threads:[~2020-09-19 10:28 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-19 10:27 [PATCH V6 00/14] multipath-tools series: some cleanups and fixes checked by codedex tool lixiaokeng
2020-09-19 10:28 ` lixiaokeng [this message]
2020-09-21 8:56 ` [PATCH V6 11/14] mpathpersist: check whether malloc paramp->trnptid_list fails in handle_args func Martin Wilck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=39c4b48b-4cc8-062e-c6c8-1207b38f576a@huawei.com \
--to=lixiaokeng@huawei.com \
--cc=bmarzins@redhat.com \
--cc=christophe.varoqui@opensvc.com \
--cc=dm-devel@redhat.com \
--cc=linfeilong@huawei.com \
--cc=liuzhiqiang26@huawei.com \
--cc=mwilck@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).