Skip to contentSkip to conversation

add kmalloc checking to fs/jffs/intrep.c (245-ac16)

PATCH In review Rasmus Andersen 2 participants 2 messages Jun 23, 2001

lore
Share & tools
lore

Rasmus Andersen

author
#0 lore raw

PATCH 1/1 add kmalloc checking to fs/jffs/intrep.c (245-ac16)

Hi.

The following patch adds some checks for kmalloc returning NULL to fs/jffs/intrep.c along with some way of getting that propagated back. Applies against 245ac16 and 246p5. These dereferences were reported by the Stanford team a way back.

fs/jffs/intrep.c +14 -4
@@ -320,8 +320,8 @@
 }
 
 
-__u32
-jffs_checksum_flash(struct mtd_info *mtd, loff_t start, int size)
+int
+jffs_checksum_flash(struct mtd_info *mtd, loff_t start, int size, __u32* checksum)
 {
 	__u32 sum = 0;
 	loff_t ptr = start;

@@ -330,6 +330,10 @@
 
 	/* Allocate read buffer */
 	read_buf = (__u8 *) kmalloc (sizeof(__u8) * 4096, GFP_KERNEL);
+	if (!read_buf) {
+		printk(KERN_ERR "(jffs:) Out of memory allocating buffer. Aborting.");
+		return -1;
+	}
 
 	/* Loop until checksum done */
 	while (size) {

@@ -357,7 +361,8 @@
 
 	/* Return result */
 	D3(printk("checksum result: 0x%08x\n", sum));
-	return sum;
+	*checksum = sum;
+	return 0;
 }
 static __inline__ void jffs_fm_write_lock(struct jffs_fmcontrol *fmc)
 {

@@ -605,6 +610,8 @@
 
 	/* Allocate read buffer */
 	read_buf = (__u8 *) kmalloc (sizeof(__u8) * 4096, GFP_KERNEL);
+	if (!read_buf) 
+		return -ENOMEM;
 
 	/* Start the scan.  */
 	while (pos < end) {

@@ -859,7 +866,10 @@
 			if (raw_inode.rename) {
 				deleted_file = flash_read_u32(fmc->mtd, pos);
 			}
-			checksum = jffs_checksum_flash(fmc->mtd, pos, raw_inode.dsize);
+			if (jffs_checksum_flash(fmc->mtd, pos, 
+						raw_inode.dsize, &checksum))
+				return -ENOMEM;
+
 			pos += raw_inode.dsize
 			       + JFFS_GET_PAD_BYTES(raw_inode.dsize);
Signature · 5 lines
Regards,
        Rasmus([email protected])

Television is called a medium because it is neither rare nor well-done. 
  -- Anonymous
#1 lore raw
Quoted 4 lines · [email protected] said:

The following patch adds some checks for kmalloc returning NULL to fs/
jffs/intrep.c along with some way of getting that propagated back. Applies against 245ac16 and 246p5. These dereferences were reported by the Stanford team a way back.

Fixed in my tree at about the same time the FTL code was, a month or so ago, along with some more important bugs. I haven't yet got round to feeding the updates to Linus - that's next on my list after the MTD stuff which is in 2.4.6.

--
dwmw2