On Sun, May 12, 2019 at 08:20:09AM +0200, Greg KH wrote:
> Yes, that worked! Now, can you resend it in a proper format that I can
> apply it in? (with changelog text, signed-off-by, etc.) as described in
> Documentation/SubmittingPatches, I will be glad to review it after the
> 5.2-rc1 release happens.
>
> thanks,
>
> greg k-h
From: Gen Zhang <blackgod016...@gmail.com>
Date: Sun, 11 May 2019 15:31:30 +0000
Subject: [PATCH] vt: Fix a missing-check bug in drivers/tty/vt/vt.c file of
Linux 5.0.14
Hi,
I found this missing-check bug in drivers/tty/vt/vt.c when I was examining the
source code.
In function con_init(), the pointer variable vc_cons[currcons].d, vc and
vc->vc_screenbuf is allocated a memory space via kzalloc().
And they are used in the following codes.
However, when there is a memory allocation error, kzalloc can be failed.
Thus null pointer (vc_cons[currcons].d, vc and vc->vc_screenbuf) dereference
may happen.
And it will cause the kernel to crash. Therefore, we should check return value
and handle an error.
And this patch works in 5.1.1.
Thank you!
Kind regards
Gen
Signed-off-by: Gen Zhang <blackgod016...@gmail.com>
---
--- drivers/tty/vt/vt.c
+++ drivers/tty/vt/vt.c
@@ -3349,10 +3349,14 @@ static int __init con_init(void)
for (currcons = 0; currcons < MIN_NR_CONSOLES; currcons++) {
vc_cons[currcons].d = vc = kzalloc(sizeof(struct vc_data),
GFP_NOWAIT);
+ if (!vc_cons[currcons].d || !vc)
+ goto err_vc;
INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
tty_port_init(&vc->port);
visual_init(vc, currcons, 1);
vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);
+ if (!vc->vc_screenbuf)
+ goto err_vc_screenbuf;
vc_init(vc, vc->vc_rows, vc->vc_cols,
currcons || !vc->vc_sw->con_save_screen);
}
@@ -3374,6 +3378,14 @@ static int __init con_init(void)
register_console(&vt_console_driver);
#endif
return 0;
+err_vc:
+ console_unlock();
+ return -ENOMEM;
+err_vc_screenbuf:
+ console_unlock();
+ kfree(vc);
+ vc_cons[currcons].d = NULL;
+ return -ENOMEM;
}
console_initcall(con_init);
---
