kzalloc() return should always be checked - notably in example code
where this may be seen as reference. On failure of allocation in
livepatch_fix1_dummy_alloc() respectively dummy_alloc() previous
allocation is freed (thanks to Petr Mladek <pmla...@suse.com> for
catching this) and NULL returned.

Signed-off-by: Nicholas Mc Guire <hof...@osadl.org>
Fixes: 439e7271dc2b ("livepatch: introduce shadow variable API")
---

Problem located with an experimental coccinelle script

Patch was compile tested with: x86_64_defconfig + FTRACE=y
FUNCTION_TRACER=y, EXPERT=y, LATENCYTOP=y, SAMPLES=y,
SAMPLE_LIVEPATCH=y

Patch is against 4.20-rc6 (localversion-next is next-20181214)
on top of 0001-livepatch-fix-non-static-warnings.patch 

 samples/livepatch/livepatch-shadow-fix1.c | 5 +++++
 samples/livepatch/livepatch-shadow-mod.c  | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/samples/livepatch/livepatch-shadow-fix1.c 
b/samples/livepatch/livepatch-shadow-fix1.c
index eaab10f..1974eb5 100644
--- a/samples/livepatch/livepatch-shadow-fix1.c
+++ b/samples/livepatch/livepatch-shadow-fix1.c
@@ -89,6 +89,11 @@ static __noclone struct dummy 
*livepatch_fix1_dummy_alloc(void)
         * pointer to handle resource release.
         */
        leak = kzalloc(sizeof(int), GFP_KERNEL);
+       if (!leak) {
+               kfree(d);
+               return NULL;
+       }
+
        klp_shadow_alloc(d, SV_LEAK, sizeof(leak), GFP_KERNEL,
                         shadow_leak_ctor, leak);
 
diff --git a/samples/livepatch/livepatch-shadow-mod.c 
b/samples/livepatch/livepatch-shadow-mod.c
index dc69da0..b4ece36 100644
--- a/samples/livepatch/livepatch-shadow-mod.c
+++ b/samples/livepatch/livepatch-shadow-mod.c
@@ -123,6 +123,10 @@ static __noclone noinline struct dummy *dummy_alloc(void)
 
        /* Oops, forgot to save leak! */
        leak = kzalloc(sizeof(int), GFP_KERNEL);
+       if (!leak) {
+               kfree(d);
+               return NULL;
+       }
 
        pr_info("%s: dummy @ %p, expires @ %lx\n",
                __func__, d, d->jiffies_expire);
-- 
2.1.4

Reply via email to