2019-05-15 06:47:10

by Gen Zhang

Subject: [Patch] slub: Fix a missing-check bug in mm/slub.c file of Linux 5.1.1

Pointer s is allocated with kmem_cache_zalloc(). And s is used in the
follwoing codes. However, when kmem_cache_zalloc fails, using s will
cause null pointer dereference and the kernel will go wrong. Thus we
check whether the kmem_cache_zalloc fails.

Signed-off-by: Gen Zhang <[email protected]>

---
--- mm/slub.c
+++ mm/slub.c
@@ -4201,6 +4201,8 @@ static struct kmem_cache * __init bootst
{
int node;
struct kmem_cache *s = kmem_cache_zalloc(kmem_cache, GFP_NOWAIT);
+ if (!s)
+ return ERR_PTR(-ENOMEM);
struct kmem_cache_node *n;

memcpy(s, static_cache, kmem_cache->object_size);
---

2019-05-19 21:33:44

by David Rientjes

Subject: Re: [Patch] slub: Fix a missing-check bug in mm/slub.c file of Linux 5.1.1

On Wed, 15 May 2019, Gen Zhang wrote:

> Pointer s is allocated with kmem_cache_zalloc(). And s is used in the
> follwoing codes. However, when kmem_cache_zalloc fails, using s will
> cause null pointer dereference and the kernel will go wrong. Thus we
> check whether the kmem_cache_zalloc fails.
>
> Signed-off-by: Gen Zhang <[email protected]>
>

It's ok if we encounter a NULL pointer dereference here, if we are ENOMEM
then there is no way to initialize the slub allocator to be able to
perform any future memory allocation. Returning an error code won't help.

> ---
> --- mm/slub.c
> +++ mm/slub.c
> @@ -4201,6 +4201,8 @@ static struct kmem_cache * __init bootst
> {
> int node;
> struct kmem_cache *s = kmem_cache_zalloc(kmem_cache, GFP_NOWAIT);
> + if (!s)
> + return ERR_PTR(-ENOMEM);
> struct kmem_cache_node *n;
>
> memcpy(s, static_cache, kmem_cache->object_size);

It's not legal to mix declarations within the C code here.