Skip to contentSkip to conversation

seqfile: fix uninitialized memory allocation in mounts_open()

PATCH New Fengguang Wu 1 participant 2 messages Aug 15, 2007 1 message not in the archive

Subsystems (2)
VFS NFS client
lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Fengguang Wu

author
#1 lore raw
Quoted 2 lines · Fengguang Wu

proc_mounts.m.buf is not explicitly zeroed at allocation time, which may later confuse the seqfile code and triggle an kfree(m->buf).

It's weird it did not show up in real world. Could I be wrong?

Quoted 17 lines
fs/proc/base.c +1 -2
@@ -380,7 +380,7 @@ static int mounts_open(struct inode *ino
 
 	if (ns) {
 		ret = -ENOMEM;
-		p = kmalloc(sizeof(struct proc_mounts), GFP_KERNEL);
+		p = kzalloc(sizeof(struct proc_mounts), GFP_KERNEL);
 		if (p) {
 			file->private_data = &p->m;
 			ret = seq_open(file, &mounts_op);
 
-

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

author
#2 lore raw

PATCH 1/1 seqfile: merge duplite code to seq_open_private()

In reply to a message not in the archive

There are dozens of calls to seq_open() that need to set m->private. Introduce seq_open_private() to remove code duplications.

Signed-off-by Fengguang Wu <[email protected]>

---
Andrew: more conversions will be made if this patch is ok.

 fs/nfs/client.c          |   24 ++----------------------
 fs/seq_file.c            |   10 ++++++++++
 include/linux/seq_file.h |    1 +
 3 files changed, 13 insertions(+), 22 deletions(-)
include/linux/seq_file.h +1 -0
@@ -33,6 +33,7 @@ struct seq_operations {
 };
 
 int seq_open(struct file *, const struct seq_operations *);
+int seq_open_private(struct file *, struct seq_operations *, void *);
 ssize_t seq_read(struct file *, char __user *, size_t, loff_t *);
 loff_t seq_lseek(struct file *, loff_t, int);
 int seq_release(struct inode *, struct file *);
fs/seq_file.c +10 -0
@@ -53,6 +53,16 @@ int seq_open(struct file *file, const st
 }
 EXPORT_SYMBOL(seq_open);
 
+int seq_open_private(struct file *file, struct seq_operations *op, void *data)
+{
+	int ret = seq_open(file, op);
+
+	if (!ret)
+		((struct seq_file *)file->private_data)->private = data;
+
+	return ret;
+}
+EXPORT_SYMBOL(seq_open_private);
 /**
  *	seq_read -	->read() method for sequential files.
  *	@file: the file to read from
fs/nfs/client.c +2 -22
@@ -1188,17 +1188,7 @@ static const struct file_operations nfs_
  */
 static int nfs_server_list_open(struct inode *inode, struct file *file)
 {
-	struct seq_file *m;
-	int ret;
-
-	ret = seq_open(file, &nfs_server_list_ops);
-	if (ret < 0)
-		return ret;
-
-	m = file->private_data;
-	m->private = PDE(inode)->data;
-
-	return 0;
+	return seq_open_private(file, &nfs_server_list_ops, PDE(inode)->data);
 }
 
 /*

@@ -1258,17 +1248,7 @@ static int nfs_server_list_show(struct s
  */
 static int nfs_volume_list_open(struct inode *inode, struct file *file)
 {
-	struct seq_file *m;
-	int ret;
-
-	ret = seq_open(file, &nfs_volume_list_ops);
-	if (ret < 0)
-		return ret;
-
-	m = file->private_data;
-	m->private = PDE(inode)->data;
-
-	return 0;
+	return seq_open_private(file, &nfs_volume_list_ops, PDE(inode)->data);
 }
 
 /*