Hello
I have written a Python script to scan the kernel for unchecked kmalloc()
calls. It found the following instances. I checked them manually, too. I would
like to fix them myself but I do not how to do a proper failure handling. So
maybe someone else can have a look.
Oliver
drivers/net/wireless/rsi/rsi_91x_mac80211.c:199
channels = kmalloc(sizeof(rsi_2ghz_channels), GFP_KERNEL);
memcpy(channels,
rsi_2ghz_channels,
sizeof(rsi_2ghz_channels));
---
drivers/net/wireless/rsi/rsi_91x_mac80211.c:208
channels = kmalloc(sizeof(rsi_5ghz_channels), GFP_KERNEL);
memcpy(channels,
rsi_5ghz_channels,
sizeof(rsi_5ghz_channels));
---
arch/mips/pmcs-msp71xx/msp_prom.c:378
argv = kmalloc(len, GFP_KERNEL);
ptr = (char *) &argv[prom_argc + 1]; /* strings follow array */
for (argc = 0; argc < prom_argc; argc++) {
argv[argc] = ptr;
strcpy(ptr, prom_argv[argc]);
ptr += strlen(prom_argv[argc]) + 1;
}
---
arch/mips/pmcs-msp71xx/msp_prom.c:399
envp = kmalloc(len, GFP_KERNEL);
ptr = (char *) &envp[i+1];
for (argc = 0; argc < i; argc++) {
envp[argc] = ptr;
strcpy(ptr, prom_envp[argc]);
ptr += strlen(prom_envp[argc]) + 1;
}
---
arch/powerpc/platforms/pseries/dlpar.c:389
hp_errlog_copy = kmalloc(sizeof(struct pseries_hp_errorlog),
GFP_KERNEL);
memcpy(hp_errlog_copy, hp_errlog, sizeof(struct pseries_hp_errorlog));
---
drivers/media/pci/cx23885/cx23885-dvb.c:1477
fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops),
GFP_KERNEL);
memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops,
sizeof(dib7000p_ops));
---
/mnt/hgfs/Projekte/linux-master (1)/linux-master/drivers/misc/lkdtm/perms.c:135
u32 *kmalloc_area = kmalloc(EXEC_SIZE, GFP_KERNEL);
execute_location(kmalloc_area, CODE_WRITE);
kfree(kmalloc_area);
}
---
/mnt/hgfs/Projekte/linux-master
(1)/linux-master/drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c:113
new_compat = kmalloc(new_len, GFP_KERNEL);
omapdss_prefix_strcpy(new_compat, new_len, prop->value, prop->length);
omapdss_update_prop(node, new_compat, new_len);
}
---
/mnt/hgfs/Projekte/linux-master
(1)/linux-master/drivers/staging/media/davinci_vpfe/dm365_ipipe.c:1267
params = kmalloc(sizeof(struct ipipe_module_params),
GFP_KERNEL);
to = (void *)params + module_if->param_offset;
size = module_if->param_size;
if (to && from && size) {
if (copy_from_user(to, (void __user *)from, size)) {
rval = -EFAULT;
break;
}
---
/mnt/hgfs/Projekte/linux-master
(1)/linux-master/drivers/staging/media/davinci_vpfe/dm365_ipipe.c:1309
params = kmalloc(sizeof(struct ipipe_module_params),
GFP_KERNEL);
from = (void *)params + module_if->param_offset;
size = module_if->param_size;
if (to && from && size) {
rval = module_if->get(ipipe, from);
if (rval)
goto error;
if (copy_to_user((void __user *)to, from, size)) {
---
