We allocate some buffers with a size that's ultimately dictated by
on-disk metadata. This metadata can be incorrect and state is supposed
to handle that by storing the data redundantly in three buckets.
Due to the use of x-family functions, we triggered a panic though, which
made an unfortunate bitflip an irrecoverable error.
Fix this by switching the allocations in question to non-panicking ones
and propagating the error. This issue has been detected by libfuzzer.
Signed-off-by: Ahmad Fatoum <a.fat...@pengutronix.de>
---
v1 -> v2:
- also check for zero byte allocations
---
common/state/backend_bucket_circular.c | 10 ++++++----
common/state/backend_bucket_direct.c | 6 +++---
2 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/common/state/backend_bucket_circular.c
b/common/state/backend_bucket_circular.c
index 6b5873aa9af1..9fe38bc9c508 100644
--- a/common/state/backend_bucket_circular.c
+++ b/common/state/backend_bucket_circular.c
@@ -265,9 +265,9 @@ static int state_backend_bucket_circular_read(struct
state_backend_storage_bucke
offset = circ->write_area - read_len;
}
- buf = xmalloc(read_len);
- if (!buf)
- return -ENOMEM;
+ buf = malloc(read_len);
+ if (ZERO_OR_NULL_PTR(buf))
+ return buf ? -EINVAL : -ENOMEM;
dev_dbg(circ->dev, "Read state from PEB %u global offset %lld length
%zd\n",
circ->eraseblock, (long long) offset, read_len);
@@ -311,7 +311,9 @@ static int state_backend_bucket_circular_write(struct
state_backend_storage_buck
* We need zero initialization so that our data comparisons don't show
* random changes
*/
- write_buf = xzalloc(written_length);
+ write_buf = calloc(1, written_length);
+ if (ZERO_OR_NULL_PTR(write_buf))
+ return write_buf ? -EINVAL : -ENOMEM;
memcpy(write_buf, buf, len);
meta = (struct state_backend_storage_bucket_circular_meta *)
diff --git a/common/state/backend_bucket_direct.c
b/common/state/backend_bucket_direct.c
index 03c752d6fe41..2ee0c7184193 100644
--- a/common/state/backend_bucket_direct.c
+++ b/common/state/backend_bucket_direct.c
@@ -92,9 +92,9 @@ static int state_backend_bucket_direct_read(struct
state_backend_storage_bucket
}
- buf = xmalloc(read_len);
- if (!buf)
- return -ENOMEM;
+ buf = malloc(read_len);
+ if (ZERO_OR_NULL_PTR(buf))
+ return buf ? -EINVAL : -ENOMEM;
dev_dbg(direct->dev, "Read state from %lld length %d\n", (long long)
direct->offset,
header_len + read_len);
--
2.39.5
