Re: [PATCH v2] target: fix a missing check of match_int
On 01/11/2019 11:31 PM, Kangjie Lu wrote: > When match_int fails, "arg" is left uninitialized and may contain random > value, thus should not be used. > The fix checks if match_int fails, and if so, returns its error code. > > Signed-off-by: Kangjie Lu > --- > drivers/target/target_core_rd.c | 15 +-- > 1 file changed, 13 insertions(+), 2 deletions(-) > > diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c > index a6e8106abd6f..3b7657b2f2f1 100644 > --- a/drivers/target/target_core_rd.c > +++ b/drivers/target/target_core_rd.c > @@ -559,6 +559,7 @@ static ssize_t rd_set_configfs_dev_params(struct > se_device *dev, > char *orig, *ptr, *opts; > substring_t args[MAX_OPT_ARGS]; > int arg, token; > + int ret; > > opts = kstrdup(page, GFP_KERNEL); > if (!opts) > @@ -573,14 +574,24 @@ static ssize_t rd_set_configfs_dev_params(struct > se_device *dev, > token = match_token(ptr, tokens, args); > switch (token) { > case Opt_rd_pages: > - match_int(args, ); > + ret = match_int(args, ); > + if (ret) { > + kfree(orig); > + return ret; Just set ret to the return value and then break, so all the error and success paths are going through the same code path.
[PATCH v2] target: fix a missing check of match_int
When match_int fails, "arg" is left uninitialized and may contain random value, thus should not be used. The fix checks if match_int fails, and if so, returns its error code. Signed-off-by: Kangjie Lu --- drivers/target/target_core_rd.c | 15 +-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c index a6e8106abd6f..3b7657b2f2f1 100644 --- a/drivers/target/target_core_rd.c +++ b/drivers/target/target_core_rd.c @@ -559,6 +559,7 @@ static ssize_t rd_set_configfs_dev_params(struct se_device *dev, char *orig, *ptr, *opts; substring_t args[MAX_OPT_ARGS]; int arg, token; + int ret; opts = kstrdup(page, GFP_KERNEL); if (!opts) @@ -573,14 +574,24 @@ static ssize_t rd_set_configfs_dev_params(struct se_device *dev, token = match_token(ptr, tokens, args); switch (token) { case Opt_rd_pages: - match_int(args, ); + ret = match_int(args, ); + if (ret) { + kfree(orig); + return ret; + } + rd_dev->rd_page_count = arg; pr_debug("RAMDISK: Referencing Page" " Count: %u\n", rd_dev->rd_page_count); rd_dev->rd_flags |= RDF_HAS_PAGE_COUNT; break; case Opt_rd_nullio: - match_int(args, ); + ret = match_int(args, ); + if (ret) { + kfree(orig); + return ret; + } + if (arg != 1) break; -- 2.17.2 (Apple Git-113)