* [PATCH] Revert "consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c"
@ 2019-06-04 18:00 Ben Hutchings
2019-06-04 19:02 ` Greg Kroah-Hartman
0 siblings, 1 reply; 3+ messages in thread
From: Ben Hutchings @ 2019-06-04 18:00 UTC (permalink / raw)
To: Greg Kroah-Hartman, Jiri Slaby; +Cc: Gen Zhang, Kees Cook, LKML
[-- Attachment #1: Type: text/plain, Size: 1551 bytes --]
This reverts commit 84ecc2f6eb1cb12e6d44818f94fa49b50f06e6ac.
con_insert_unipair() is working with a sparse 3-dimensional array:
- p->uni_pgdir[] is the top layer
- p1 points to a middle layer
- p2 points to a bottom layer
If it needs to allocate a new middle layer, and then fails to allocate
a new bottom layer, it would previously free only p2, and now it frees
both p1 and p2. But since the new middle layer was already registered
in the top layer, it was not leaked.
However, if it looks up an *existing* middle layer and then fails to
allocate a bottom layer, it now frees both p1 and p2 but does *not*
free any other bottom layers under p1. So it *introduces* a memory
leak.
The error path also cleared the wrong index in p->uni_pgdir[],
introducing a use-after-free.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/tty/vt/consolemap.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
index 79fcc96cc7c0..b28aa0d289f8 100644
--- a/drivers/tty/vt/consolemap.c
+++ b/drivers/tty/vt/consolemap.c
@@ -489,11 +489,7 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos)
p2 = p1[n = (unicode >> 6) & 0x1f];
if (!p2) {
p2 = p1[n] = kmalloc_array(64, sizeof(u16), GFP_KERNEL);
- if (!p2) {
- kfree(p1);
- p->uni_pgdir[n] = NULL;
- return -ENOMEM;
- }
+ if (!p2) return -ENOMEM;
memset(p2, 0xff, 64*sizeof(u16)); /* No glyphs for the characters (yet) */
}
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] Revert "consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c"
2019-06-04 18:00 [PATCH] Revert "consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c" Ben Hutchings
@ 2019-06-04 19:02 ` Greg Kroah-Hartman
2019-06-05 16:16 ` Gen Zhang
0 siblings, 1 reply; 3+ messages in thread
From: Greg Kroah-Hartman @ 2019-06-04 19:02 UTC (permalink / raw)
To: Ben Hutchings; +Cc: Jiri Slaby, Gen Zhang, Kees Cook, LKML
On Tue, Jun 04, 2019 at 07:00:39PM +0100, Ben Hutchings wrote:
> This reverts commit 84ecc2f6eb1cb12e6d44818f94fa49b50f06e6ac.
>
> con_insert_unipair() is working with a sparse 3-dimensional array:
>
> - p->uni_pgdir[] is the top layer
> - p1 points to a middle layer
> - p2 points to a bottom layer
>
> If it needs to allocate a new middle layer, and then fails to allocate
> a new bottom layer, it would previously free only p2, and now it frees
> both p1 and p2. But since the new middle layer was already registered
> in the top layer, it was not leaked.
>
> However, if it looks up an *existing* middle layer and then fails to
> allocate a bottom layer, it now frees both p1 and p2 but does *not*
> free any other bottom layers under p1. So it *introduces* a memory
> leak.
>
> The error path also cleared the wrong index in p->uni_pgdir[],
> introducing a use-after-free.
>
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Now applied, thanks.
Gen, please be careful with these types of "fixes"...
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] Revert "consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c"
2019-06-04 19:02 ` Greg Kroah-Hartman
@ 2019-06-05 16:16 ` Gen Zhang
0 siblings, 0 replies; 3+ messages in thread
From: Gen Zhang @ 2019-06-05 16:16 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: Ben Hutchings, Jiri Slaby, Kees Cook, LKML
On Tue, Jun 04, 2019 at 09:02:34PM +0200, Greg Kroah-Hartman wrote:
> On Tue, Jun 04, 2019 at 07:00:39PM +0100, Ben Hutchings wrote:
> > This reverts commit 84ecc2f6eb1cb12e6d44818f94fa49b50f06e6ac.
> >
> > con_insert_unipair() is working with a sparse 3-dimensional array:
> >
> > - p->uni_pgdir[] is the top layer
> > - p1 points to a middle layer
> > - p2 points to a bottom layer
> >
> > If it needs to allocate a new middle layer, and then fails to allocate
> > a new bottom layer, it would previously free only p2, and now it frees
> > both p1 and p2. But since the new middle layer was already registered
> > in the top layer, it was not leaked.
> >
> > However, if it looks up an *existing* middle layer and then fails to
> > allocate a bottom layer, it now frees both p1 and p2 but does *not*
> > free any other bottom layers under p1. So it *introduces* a memory
> > leak.
> >
> > The error path also cleared the wrong index in p->uni_pgdir[],
> > introducing a use-after-free.
> >
> > Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
>
> Now applied, thanks.
>
> Gen, please be careful with these types of "fixes"...
Thanks for your comments. I will for sure. And I am always submutting
patches and revising it according to the maintainers.
Thanks
Gen
>
> thanks,
>
> greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-06-05 16:16 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-04 18:00 [PATCH] Revert "consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c" Ben Hutchings
2019-06-04 19:02 ` Greg Kroah-Hartman
2019-06-05 16:16 ` Gen Zhang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).