2023-12-11 08:27:12

by Kunwu Chan

Subject: [PATCH] bcache: Fix NULL pointer dereference in bch_cached_dev_run

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.

Cc: Kunwu Chan <[email protected]>
Signed-off-by: Kunwu Chan <[email protected]>
---
drivers/md/bcache/super.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 1402096b8076..40b657887d3b 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1053,6 +1053,12 @@ int bch_cached_dev_run(struct cached_dev *dc)
NULL,
};

+ if (!env[1] || !env[2]) {
+ pr_err("Couldn't create bcache dev <-> fail to allocate memory\n");
+ ret = -ENOMEM;
+ goto out;
+ }
+
if (dc->io_disable) {
pr_err("I/O disabled on cached dev %pg\n", dc->bdev);
ret = -EIO;
--
2.39.2

2023-12-19 07:08:37

by Coly Li

Subject: Re: [PATCH] bcache: Fix NULL pointer dereference in bch_cached_dev_run

On Mon, Dec 11, 2023 at 04:25:10PM +0800, Kunwu Chan wrote:
> kasprintf() returns a pointer to dynamically allocated memory
> which can be NULL upon failure.
>

If you check kobject_uevent_env(), you will find the NULL pointer dereference
won't happen. Sending env[1] or env[2] as NULL into kobject_uevent_env() just
results an unexpected udev event message, IMHO it is better than nothing.

> Cc: Kunwu Chan <[email protected]>
> Signed-off-by: Kunwu Chan <[email protected]>

Why this patch is Cced to another email address of same person?

Thanks.

Coly Li

> ---
> drivers/md/bcache/super.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
> index 1402096b8076..40b657887d3b 100644
> --- a/drivers/md/bcache/super.c
> +++ b/drivers/md/bcache/super.c
> @@ -1053,6 +1053,12 @@ int bch_cached_dev_run(struct cached_dev *dc)
> NULL,
> };
>
> + if (!env[1] || !env[2]) {
> + pr_err("Couldn't create bcache dev <-> fail to allocate memory\n");
> + ret = -ENOMEM;
> + goto out;
> + }
> +
> if (dc->io_disable) {
> pr_err("I/O disabled on cached dev %pg\n", dc->bdev);
> ret = -EIO;
> --
> 2.39.2
>
>

--
Coly Li