Skip to contentSkip to conversation

seqfile: fix uninitialized memory allocation in mounts_open()

PATCH In review Fengguang Wu 2 participants 3 messages Aug 15, 2007 Proc filesystem

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 seqfile: fix uninitialized memory allocation in mounts_open()

proc_mounts.m.buf is not explicitly zeroed at allocation time, which may later confuse the seqfile code and triggle an kfree(m->buf).

---

fs/proc/base.c +1 -1
@@ -380,7 +380,7 @@ static int mounts_open(struct inode *ino
 
 	if (ns) {
 		ret = -ENOMEM;
-		p = kmalloc(sizeof(struct proc_mounts), GFP_KERNEL);
+		p = kzalloc(sizeof(struct proc_mounts), GFP_KERNEL);
 		if (p) {
 			file->private_data = &p->m;
 			ret = seq_open(file, &mounts_op);
#1 lore raw
Quoted 2 lines · Fengguang Wu

proc_mounts.m.buf is not explicitly zeroed at allocation time, which may later confuse the seqfile code and triggle an kfree(m->buf).

It's cleared in seq_open().

Quoted 11 lines
fs/proc/base.c +1 -1
@@ -380,7 +380,7 @@ static int mounts_open(struct inode *ino
 
 	if (ns) {
 		ret = -ENOMEM;
-		p = kmalloc(sizeof(struct proc_mounts), GFP_KERNEL);
+		p = kzalloc(sizeof(struct proc_mounts), GFP_KERNEL);
 		if (p) {
 			file->private_data = &p->m;
 			ret = seq_open(file, &mounts_op);
#2 lore raw
Quoted 5 lines · Alexey Dobriyan
Quoted 2 lines · Fengguang Wu

proc_mounts.m.buf is not explicitly zeroed at allocation time, which may later confuse the seqfile code and triggle an kfree(m->buf).

It's cleared in seq_open().

So it is :)

Quoted 11 lines
Quoted 11 lines
fs/proc/base.c +1 -1
@@ -380,7 +380,7 @@ static int mounts_open(struct inode *ino
 
 	if (ns) {
 		ret = -ENOMEM;
-		p = kmalloc(sizeof(struct proc_mounts), GFP_KERNEL);
+		p = kzalloc(sizeof(struct proc_mounts), GFP_KERNEL);
 		if (p) {
 			file->private_data = &p->m;
 			ret = seq_open(file, &mounts_op);