|
 |
25786b |
From 626bc45396c4959f2c4685c2faa7c4f553f4efdf Mon Sep 17 00:00:00 2001
|
|
|
25786b |
From: Mateusz Grzonka <mateusz.grzonka@intel.com>
|
|
|
25786b |
Date: Mon, 13 Jun 2022 11:59:34 +0200
|
|
|
91179e |
Subject: [PATCH 18/83] Fix possible NULL ptr dereferences and memory leaks
|
|
|
25786b |
|
|
|
25786b |
In Assemble there was a NULL check for sra variable,
|
|
|
25786b |
which effectively didn't stop the execution in every case.
|
|
|
25786b |
That might have resulted in a NULL pointer dereference.
|
|
|
25786b |
|
|
|
25786b |
Also in super-ddf, mu variable was set to NULL for some condition,
|
|
|
25786b |
and then immidiately dereferenced.
|
|
|
25786b |
Additionally some memory wasn't freed as well.
|
|
|
25786b |
|
|
|
25786b |
Signed-off-by: Mateusz Grzonka <mateusz.grzonka@intel.com>
|
|
|
25786b |
Signed-off-by: Jes Sorensen <jsorensen@fb.com>
|
|
|
25786b |
---
|
|
|
25786b |
Assemble.c | 7 ++++++-
|
|
|
25786b |
super-ddf.c | 9 +++++++--
|
|
|
25786b |
2 files changed, 13 insertions(+), 3 deletions(-)
|
|
|
25786b |
|
|
|
25786b |
diff --git a/Assemble.c b/Assemble.c
|
|
|
25786b |
index 9eac9ce0..4b213560 100644
|
|
|
25786b |
--- a/Assemble.c
|
|
|
25786b |
+++ b/Assemble.c
|
|
|
25786b |
@@ -1982,7 +1982,12 @@ int assemble_container_content(struct supertype *st, int mdfd,
|
|
|
25786b |
}
|
|
|
25786b |
|
|
|
25786b |
sra = sysfs_read(mdfd, NULL, GET_VERSION|GET_DEVS);
|
|
|
25786b |
- if (sra == NULL || strcmp(sra->text_version, content->text_version) != 0) {
|
|
|
25786b |
+ if (sra == NULL) {
|
|
|
25786b |
+ pr_err("Failed to read sysfs parameters\n");
|
|
|
25786b |
+ return 1;
|
|
|
25786b |
+ }
|
|
|
25786b |
+
|
|
|
25786b |
+ if (strcmp(sra->text_version, content->text_version) != 0) {
|
|
|
25786b |
if (content->array.major_version == -1 &&
|
|
|
25786b |
content->array.minor_version == -2 &&
|
|
|
25786b |
c->readonly &&
|
|
|
25786b |
diff --git a/super-ddf.c b/super-ddf.c
|
|
|
25786b |
index 8cda23a7..abbc8b09 100644
|
|
|
25786b |
--- a/super-ddf.c
|
|
|
25786b |
+++ b/super-ddf.c
|
|
|
25786b |
@@ -5125,13 +5125,16 @@ static struct mdinfo *ddf_activate_spare(struct active_array *a,
|
|
|
25786b |
*/
|
|
|
25786b |
vc = find_vdcr(ddf, a->info.container_member, rv->disk.raid_disk,
|
|
|
25786b |
&n_bvd, &vcl;;
|
|
|
25786b |
- if (vc == NULL)
|
|
|
25786b |
+ if (vc == NULL) {
|
|
|
25786b |
+ free(rv);
|
|
|
25786b |
return NULL;
|
|
|
25786b |
+ }
|
|
|
25786b |
|
|
|
25786b |
mu = xmalloc(sizeof(*mu));
|
|
|
25786b |
if (posix_memalign(&mu->space, 512, sizeof(struct vcl)) != 0) {
|
|
|
25786b |
free(mu);
|
|
|
25786b |
- mu = NULL;
|
|
|
25786b |
+ free(rv);
|
|
|
25786b |
+ return NULL;
|
|
|
25786b |
}
|
|
|
25786b |
|
|
|
25786b |
mu->len = ddf->conf_rec_len * 512 * vcl->conf.sec_elmnt_count;
|
|
|
25786b |
@@ -5161,6 +5164,8 @@ static struct mdinfo *ddf_activate_spare(struct active_array *a,
|
|
|
25786b |
pr_err("BUG: can't find disk %d (%d/%d)\n",
|
|
|
25786b |
di->disk.raid_disk,
|
|
|
25786b |
di->disk.major, di->disk.minor);
|
|
|
25786b |
+ free(mu);
|
|
|
25786b |
+ free(rv);
|
|
|
25786b |
return NULL;
|
|
|
25786b |
}
|
|
|
25786b |
vc->phys_refnum[i_prim] = ddf->phys->entries[dl->pdnum].refnum;
|
|
|
25786b |
--
|
|
|
91179e |
2.38.1
|
|
|
25786b |
|