UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

um: Fix initialization of vector queues 

UML vector drivers could derefence uninitialized memory
when cleaning up after a queue allocation failure.

Fixes: 49da7e64f3 ("High Performance UML Vector Network Driver")
Cc: <stable@vger.kernel.org>
Reported-by: Dan Capenter <dan.carpenter@oracle.com>
Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
This commit is contained in:
Anton Ivanov 2018-06-05 09:27:30 +01:00 committed by Richard Weinberger
parent cca76c1ad6
commit 4579a1ba69
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
arch/um/drivers/vector_kern.c
View File

@ -504,15 +504,19 @@ static struct vector_queue *create_queue(
result = kmalloc(sizeof(struct vector_queue), GFP_KERNEL); result = kmalloc(sizeof(struct vector_queue), GFP_KERNEL);
if (result == NULL) if (result == NULL)
goto out_fail; return NULL;
result->max_depth = max_size; result->max_depth = max_size;
result->dev = vp->dev; result->dev = vp->dev;
result->mmsg_vector = kmalloc( result->mmsg_vector = kmalloc(
(sizeof(struct mmsghdr) * max_size), GFP_KERNEL); (sizeof(struct mmsghdr) * max_size), GFP_KERNEL);
if (result->mmsg_vector == NULL)
goto out_mmsg_fail;
result->skbuff_vector = kmalloc( result->skbuff_vector = kmalloc(
(sizeof(void *) * max_size), GFP_KERNEL); (sizeof(void *) * max_size), GFP_KERNEL);
if (result->mmsg_vector == NULL || result->skbuff_vector == NULL) if (result->skbuff_vector == NULL)
goto out_fail; goto out_skb_fail;
/* further failures can be handled safely by destroy_queue*/
mmsg_vector = result->mmsg_vector; mmsg_vector = result->mmsg_vector;
for (i = 0; i < max_size; i++) { for (i = 0; i < max_size; i++) {
@ -563,6 +567,11 @@ static struct vector_queue *create_queue(
result->head = 0; result->head = 0;
result->tail = 0; result->tail = 0;
return result; return result;
out_skb_fail:
kfree(result->mmsg_vector);
out_mmsg_fail:
kfree(result);
return NULL;
out_fail: out_fail:
destroy_queue(result); destroy_queue(result);
return NULL; return NULL;