monitor: fix nullptr dereference when get_md_name() returns NULL

PATCH Superseded Sergey Vidishev 3 participants 6 messages Oct 10, 2014 – May 20, 2015 MD RAID

Share & tools

Sergey Vidishev

author

2014-10-10 13:23 UTC #0 lore raw

PATCH 1/1 monitor: fix nullptr dereference when get_md_name() returns NULL

From f35857936a8df2155b9aee3759c91fc19b77842c Mon Sep 17 00:00:00 2001
From: Sergey Vidishev <[email protected]>
Date: Wed, 8 Oct 2014 21:51:03 +0400
Subject: [PATCH] monitor: fix nullptr dereference when get_md_name() returns NULL

Signed-off-by Sergey Vidishev <[email protected]>

---

This patch against fresh git://neil.brown.name/mdadm.
I'm not subscribed to the list, please CC me in replies.

 Monitor.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

Monitor.c +7 -1

index 5cb24fa..1919f99 100644
@@ -668,6 +668,7 @@ static int add_new_arrays(struct mdstat_ent *mdstat, struct state **statelist,
 {
 	struct mdstat_ent *mse;
 	int new_found = 0;
+	char *name;
 
 	for (mse=mdstat; mse; mse=mse->next)
 		if (mse->devnm[0] &&

@@ -678,7 +679,12 @@ static int add_new_arrays(struct mdstat_ent *mdstat, struct state **statelist,
 			struct state *st = xcalloc(1, sizeof *st);
 			mdu_array_info_t array;
 			int fd;
-			st->devname = xstrdup(get_md_name(mse->devnm));
+
+			name = get_md_name(mse->devnm);
+			if (!name)
+				return 0;
+
+			st->devname = xstrdup(name);
 			if ((fd = open(st->devname, O_RDONLY)) < 0 ||
 			    ioctl(fd, GET_ARRAY_INFO, &array)< 0) {
 				/* no such array */

Signature · 1 line

1.9.1

Sergey Vidishev

author

2015-05-18 23:33 UTC #1 lore raw

PATCH v2 1/1 mdadm: monitor: fix nullptr dereference when get_md_name() returns NULL

From c1e59424bfabee349aa7b8b903833475a56cf145 Mon Sep 17 00:00:00 2001
From: Sergey Vidishev <[email protected]>
Date: Wed, 8 Oct 2014 21:51:03 +0400
Subject: [PATCH] mdadm: monitor: fix nullptr dereference when get_md_name()
returns NULL

Function add_new_arrays() expects that function get_md_name() should return pointer to devname, but also get_md_name() may return NULL. So check the pointer before use it in add_new_arrays().

Signed-off-by Sergey Vidishev <[email protected]>

---

v1 -> v2: more verbose commit message

This patch against fresh git://neil.brown.name/mdadm.
I'm not subscribed to the list, please CC me in replies.

 Monitor.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

Monitor.c +7 -1

index 1cd378b..1bbaf89 100644
@@ -687,6 +687,7 @@ static int add_new_arrays(struct mdstat_ent *mdstat, struct state **statelist,
 {
 	struct mdstat_ent *mse;
 	int new_found = 0;
+	char *name;
 
 	for (mse=mdstat; mse; mse=mse->next)
 		if (mse->devnm[0] &&

@@ -697,7 +698,12 @@ static int add_new_arrays(struct mdstat_ent *mdstat, struct state **statelist,
 			struct state *st = xcalloc(1, sizeof *st);
 			mdu_array_info_t array;
 			int fd;
-			st->devname = xstrdup(get_md_name(mse->devnm));
+
+			name = get_md_name(mse->devnm);
+			if (!name)
+				return 0;
+
+			st->devname = xstrdup(name);
 			if ((fd = open(st->devname, O_RDONLY)) < 0 ||
 			    ioctl(fd, GET_ARRAY_INFO, &array)< 0) {
 				/* no such array */

Signature · 1 line

1.9.1

David F.

2015-05-19 01:42 UTC #2 lore raw

Re: [PATCH v2] mdadm: monitor: fix nullptr dereference when get_md_name() returns NULL

not sure if that causes a memory leak since st not freed ?

Quoted 55 lines · Sergey Vidishev

From c1e59424bfabee349aa7b8b903833475a56cf145 Mon Sep 17 00:00:00 2001
From: Sergey Vidishev <[email protected]>
Date: Wed, 8 Oct 2014 21:51:03 +0400
Subject: [PATCH] mdadm: monitor: fix nullptr dereference when get_md_name()
returns NULL
Function add_new_arrays() expects that function get_md_name() should return pointer to devname, but also get_md_name() may return NULL. So check the pointer before use it in add_new_arrays().
Signed-off-by Sergey Vidishev <[email protected]>
---
v1 -> v2: more verbose commit message
This patch against fresh git://neil.brown.name/mdadm.
I'm not subscribed to the list, please CC me in replies.
 Monitor.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
Monitor.c +7 -2
index 1cd378b..1bbaf89 100644
@@ -687,6 +687,7 @@ static int add_new_arrays(struct mdstat_ent *mdstat, struct state **statelist,
 {
        struct mdstat_ent *mse;
        int new_found = 0;
+       char *name;
 
        for (mse=mdstat; mse; mse=mse->next)
                if (mse->devnm[0] &&
@@ -697,7 +698,12 @@ static int add_new_arrays(struct mdstat_ent *mdstat, struct state **statelist,
                        struct state *st = xcalloc(1, sizeof *st);
                        mdu_array_info_t array;
                        int fd;
-                       st->devname = xstrdup(get_md_name(mse->devnm));
+
+                       name = get_md_name(mse->devnm);
+                       if (!name)
+                               return 0;
+
+                       st->devname = xstrdup(name);
                        if ((fd = open(st->devname, O_RDONLY)) < 0 ||
                            ioctl(fd, GET_ARRAY_INFO, &array)< 0) {
                                /* no such array */
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-raid" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Sergey Vidishev

author

2015-05-19 18:39 UTC #3 lore raw

Re: [PATCH v2] mdadm: monitor: fix nullptr dereference when get_md_name() returns NULL

Quoted 1 line · David F.

not sure if that causes a memory leak since st not freed ?

You're right, thanks!

Also I did reviewed the code and replaced return with continue since it's more correct to skip an mse's (if get_md_name() returned NULL for it) instead of return.

I'll resend the patch.

Quoted 1 line

On Mon, May 18, 2015 at 4:33 PM, Sergey Vidishev <[email protected]>

Quoted 68 lines · wrote:

Quoted 68 lines
From c1e59424bfabee349aa7b8b903833475a56cf145 Mon Sep 17 00:00:00 2001
From: Sergey Vidishev <[email protected]>
Date: Wed, 8 Oct 2014 21:51:03 +0400
Subject: [PATCH] mdadm: monitor: fix nullptr dereference when get_md_name()
returns NULL
Function add_new_arrays() expects that function get_md_name() should return pointer to devname, but also get_md_name() may return NULL. So check the pointer before use it in add_new_arrays().
Signed-off-by Sergey Vidishev <[email protected]>
---
v1 -> v2: more verbose commit message
This patch against fresh git://neil.brown.name/mdadm.
I'm not subscribed to the list, please CC me in replies.
 Monitor.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
Monitor.c +0 -0
index 1cd378b..1bbaf89 100644
@@ -687,6 +687,7 @@ static int add_new_arrays(struct mdstat_ent *mdstat,
struct state **statelist,>
{
        struct mdstat_ent *mse;
        int new_found = 0;
Monitor.c +1 -0
+       char *name;
 
        for (mse=mdstat; mse; mse=mse->next)
 
                if (mse->devnm[0] &&
@@ -697,7 +698,12 @@ static int add_new_arrays(struct mdstat_ent *mdstat,
struct state **statelist,>
                        struct state *st = xcalloc(1, sizeof *st);
                        mdu_array_info_t array;
                        int fd;
Monitor.c +6 -2
-                       st->devname = xstrdup(get_md_name(mse->devnm));
+
+                       name = get_md_name(mse->devnm);
+                       if (!name)
+                               return 0;
+
+                       st->devname = xstrdup(name);
 
                        if ((fd = open(st->devname, O_RDONLY)) < 0 ||
 
                            ioctl(fd, GET_ARRAY_INFO, &array)< 0) {
 
                                /* no such array */
 
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-raid" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Sergey Vidishev

author

2015-05-19 19:02 UTC #4 lore raw

PATCH v3 1/1 mdadm: monitor: fix nullptr dereference when get_md_name() returns NULL

From fce3be7200e84665cdae58ba44d5c61af094af3b Mon Sep 17 00:00:00 2001
From: Sergey Vidishev <[email protected]>
Date: Tue, 19 May 2015 20:34:58 +0300
Subject: [PATCH] mdadm: monitor: fix nullptr dereference when get_md_name()
returns NULL

Function add_new_arrays() expects that function get_md_name() should return pointer to devname, but also get_md_name() may return NULL. So check the pointer before use it in add_new_arrays().

Signed-off-by Sergey Vidishev <[email protected]>

---

v2 -> v3: - continue instead of return
- avoid mem leak (thanks to David F.)
v1 -> v2: more verbose commit message

 Monitor.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

Monitor.c +9 -1

index 1cd378b..a530032 100644
@@ -687,6 +687,7 @@ static int add_new_arrays(struct mdstat_ent *mdstat, struct state **statelist,
 {
 	struct mdstat_ent *mse;
 	int new_found = 0;
+	char *name;
 
 	for (mse=mdstat; mse; mse=mse->next)
 		if (mse->devnm[0] &&

@@ -697,7 +698,14 @@ static int add_new_arrays(struct mdstat_ent *mdstat, struct state **statelist,
 			struct state *st = xcalloc(1, sizeof *st);
 			mdu_array_info_t array;
 			int fd;
-			st->devname = xstrdup(get_md_name(mse->devnm));
+
+			name = get_md_name(mse->devnm);
+			if (!name) {
+				free(st);
+				continue;
+			}
+
+			st->devname = xstrdup(name);
 			if ((fd = open(st->devname, O_RDONLY)) < 0 ||
 			    ioctl(fd, GET_ARRAY_INFO, &array)< 0) {
 				/* no such array */

Signature · 1 line

2.0.4

NeilBrown

Applied

2015-05-20 03:16 UTC #5 lore raw

Re: [PATCH v3] mdadm: monitor: fix nullptr dereference when get_md_name() returns NULL

Quoted 38 lines · On Tue, 19 May 2015 22:02:46 +0300 Sergey Vidishev <[email protected]>…

Quoted 1 line
From fce3be7200e84665cdae58ba44d5c61af094af3b Mon Sep 17 00:00:00 2001
From: Sergey Vidishev <[email protected]>
Date: Tue, 19 May 2015 20:34:58 +0300
Subject: [PATCH] mdadm: monitor: fix nullptr dereference when get_md_name()
returns NULL
Function add_new_arrays() expects that function get_md_name() should return pointer to devname, but also get_md_name() may return NULL. So check the pointer before use it in add_new_arrays().
Signed-off-by Sergey Vidishev <[email protected]>
---
v2 -> v3: - continue instead of return
- avoid mem leak (thanks to David F.)
v1 -> v2: more verbose commit message
 Monitor.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)
Monitor.c +2 -1
index 1cd378b..a530032 100644
@@ -687,6 +687,7 @@ static int add_new_arrays(struct mdstat_ent *mdstat, struct state **statelist,
 {
 	struct mdstat_ent *mse;
 	int new_found = 0;
+	char *name;
 
 	for (mse=mdstat; mse; mse=mse->next)
 		if (mse->devnm[0] &&
@@ -697,7 +698,14 @@ static int add_new_arrays(struct mdstat_ent *mdstat, struct state **statelist,
 			struct state *st = xcalloc(1, sizeof *st);
 			mdu_array_info_t array;
 			int fd;
-			st->devname = xstrdup(get_md_name(mse->devnm));
+

Monitor.c static int add_new_arrays(struct mdstat_ent *mdstat, struct state **statelist, · line 711

Quoted 10 lines

Monitor.c +7 -0

+			name = get_md_name(mse->devnm);
+			if (!name) {
+				free(st);
+				continue;
+			}
+
+			st->devname = xstrdup(name);
 			if ((fd = open(st->devname, O_RDONLY)) < 0 ||
 			    ioctl(fd, GET_ARRAY_INFO, &array)< 0) {
 				/* no such array */

Applied, thanks.
And thanks David for the review help!

NeilBrown