Hi.
The following patch adds some checks for kmalloc returning NULL
to fs/jffs/intrep.c along with some way of getting that propagated
back. Applies against 245ac16 and 246p5. These dereferences were
reported by the Stanford team a way back.
--- linux-245-ac16-clean/fs/jffs/intrep.c Thu Jun 21 21:26:24 2001
+++ linux-245-ac16/fs/jffs/intrep.c Sat Jun 23 16:25:33 2001
@@ -320,8 +320,8 @@
}
-__u32
-jffs_checksum_flash(struct mtd_info *mtd, loff_t start, int size)
+int
+jffs_checksum_flash(struct mtd_info *mtd, loff_t start, int size, __u32* checksum)
{
__u32 sum = 0;
loff_t ptr = start;
@@ -330,6 +330,10 @@
/* Allocate read buffer */
read_buf = (__u8 *) kmalloc (sizeof(__u8) * 4096, GFP_KERNEL);
+ if (!read_buf) {
+ printk(KERN_ERR "(jffs:) Out of memory allocating buffer. Aborting.");
+ return -1;
+ }
/* Loop until checksum done */
while (size) {
@@ -357,7 +361,8 @@
/* Return result */
D3(printk("checksum result: 0x%08x\n", sum));
- return sum;
+ *checksum = sum;
+ return 0;
}
static __inline__ void jffs_fm_write_lock(struct jffs_fmcontrol *fmc)
{
@@ -605,6 +610,8 @@
/* Allocate read buffer */
read_buf = (__u8 *) kmalloc (sizeof(__u8) * 4096, GFP_KERNEL);
+ if (!read_buf)
+ return -ENOMEM;
/* Start the scan. */
while (pos < end) {
@@ -859,7 +866,10 @@
if (raw_inode.rename) {
deleted_file = flash_read_u32(fmc->mtd, pos);
}
- checksum = jffs_checksum_flash(fmc->mtd, pos, raw_inode.dsize);
+ if (jffs_checksum_flash(fmc->mtd, pos,
+ raw_inode.dsize, &checksum))
+ return -ENOMEM;
+
pos += raw_inode.dsize
+ JFFS_GET_PAD_BYTES(raw_inode.dsize);
--
Regards,
Rasmus([EMAIL PROTECTED])
Television is called a medium because it is neither rare nor well-done.
-- Anonymous
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
