From: Anatolii Nikulin Date: Tue, 25 Aug 2015 12:52:36 +0000 (+0300) Subject: [FIX] prevent issues X-Git-Tag: submit/tizen_2.4/20150912.103527~38 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fchanges%2F38%2F46738%2F2;p=kernel%2Fswap-modules.git [FIX] prevent issues fix 42 issues from prevent: NULL_RETURNS UNINIT REVERSE_INULL RESOURCE_LEAK MISSING_BREAK DEADCODE DC.SECURE_CODING_SPRINTF FORWARD_NULL DC.SECURE_CODING_STRCPY OVERFLOW_BEFORE_WIDEN BAD_SIZEOF Change-Id: I1e7bc4b6e73e8262ee6fa23238d86a62510cb4e5 Signed-off-by: Anatolii Nikulin --- diff --git a/fbiprobe/fbiprobe.c b/fbiprobe/fbiprobe.c index d507502..bd51162 100644 --- a/fbiprobe/fbiprobe.c +++ b/fbiprobe/fbiprobe.c @@ -341,12 +341,15 @@ int fbi_probe_copy(struct probe_info *dest, const struct probe_info *source) struct fbi_step *steps_source; struct fbi_step *steps_dest = NULL; uint8_t i; - + int ret = 0; memcpy(dest, source, sizeof(*source)); vars_size = source->fbi_i.var_count * sizeof(*source->fbi_i.vars); vars = kmalloc(vars_size, GFP_KERNEL); + if (vars == NULL) + return -ENOMEM; + memcpy(vars, source->fbi_i.vars, vars_size); for (i = 0; i != source->fbi_i.var_count; i++) { @@ -359,7 +362,8 @@ int fbi_probe_copy(struct probe_info *dest, const struct probe_info *source) steps_dest = kmalloc(steps_size, GFP_KERNEL); if (steps_dest == NULL) { print_err("can not alloc data\n"); - return -ENOMEM; + ret = -ENOMEM; + goto err; } memcpy(steps_dest, steps_source, steps_size); @@ -369,7 +373,12 @@ int fbi_probe_copy(struct probe_info *dest, const struct probe_info *source) dest->fbi_i.vars = vars; - return 0; + return ret; +err: + while (--i >= 0) + kfree(vars[i].steps); + kfree(vars); + return ret; } /* Register */ diff --git a/kprobe/swap_kprobes_deps.c b/kprobe/swap_kprobes_deps.c index d5179a6..5c4bef4 100644 --- a/kprobe/swap_kprobes_deps.c +++ b/kprobe/swap_kprobes_deps.c @@ -273,7 +273,12 @@ static inline int swap_in_gate_area(struct task_struct *task, { #ifdef __HAVE_ARCH_GATE_AREA #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 38) - struct mm_struct *mm = task->mm; + struct mm_struct *mm; + + if (task == NULL) + return 0; + + mm = task->mm; IMP_MOD_DEP_WRAPPER(in_gate_area, mm, addr) #else /* LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 38) */ IMP_MOD_DEP_WRAPPER(in_gate_area, task, addr) diff --git a/kprobe/swap_slots.c b/kprobe/swap_slots.c index c6406a0..f0aea18 100644 --- a/kprobe/swap_slots.c +++ b/kprobe/swap_slots.c @@ -97,6 +97,12 @@ static void chunk_init(struct chunk *chunk, chunk->index = kmalloc(sizeof(*chunk->index)*chunk->count_available, GFP_ATOMIC); + + if (chunk->index == NULL) { + printk(KERN_ERR "%s: failed to allocate memory\n", __FUNCTION__); + return; + } + p = chunk->index; for (i = 0; i != chunk->count_available; ++p) *p = ++i; diff --git a/ks_features/file_ops.c b/ks_features/file_ops.c index e0fd724..8845a74 100644 --- a/ks_features/file_ops.c +++ b/ks_features/file_ops.c @@ -660,7 +660,7 @@ static char *__fops_dpath(struct dentry *dentry, char *buf, int buflen) if (IS_ERR_OR_NULL(filename)) { printk(FOPS_PREFIX "dentry_path_raw FAILED: %ld\n", PTR_ERR(filename)); - strcpy(buf, NA); + strncpy(buf, NA, buflen); filename = buf; } diff --git a/ks_features/ks_features.c b/ks_features/ks_features.c index 3993cb8..f462e7a 100644 --- a/ks_features/ks_features.c +++ b/ks_features/ks_features.c @@ -300,7 +300,7 @@ static int unregister_multiple_syscalls(size_t *id_p, size_t cnt) --cnt; - rpp = kmalloc(GFP_KERNEL, sizeof(&(((struct ks_probe *) 0)->rp)) * cnt); + rpp = kmalloc(GFP_KERNEL, sizeof(*rpp) * cnt); if (rpp == NULL) { for (; cnt != end; --cnt) { ret = unregister_syscall(id_p[cnt]); diff --git a/ks_manager/ks_manager.c b/ks_manager/ks_manager.c index fc1c9e9..a8abc65 100644 --- a/ks_manager/ks_manager.c +++ b/ks_manager/ks_manager.c @@ -40,6 +40,9 @@ static struct probe *create_probe(unsigned long addr, void *pre_handler, { struct probe *p = kzalloc(sizeof(*p), GFP_KERNEL); + if (p == NULL) + return NULL; + p->p.jp.kp.addr = p->p.rp.kp.addr = (void *)addr; p->p.jp.pre_entry = pre_handler; p->p.jp.entry = jp_handler; diff --git a/preload/preload_control.c b/preload/preload_control.c index 5a79c84..2f5aef8 100644 --- a/preload/preload_control.c +++ b/preload/preload_control.c @@ -257,6 +257,9 @@ unsigned int preload_control_get_bin_names(char ***filenames_p) int i; unsigned int ret = 0; + if (target_binaries_cnt == 0) + return 0; + __target_binaries_lock(); *filenames_p = kmalloc(sizeof(**filenames_p) * target_binaries_cnt, diff --git a/preload/preload_debugfs.c b/preload/preload_debugfs.c index 8af94bb..9e412c9 100644 --- a/preload/preload_debugfs.c +++ b/preload/preload_debugfs.c @@ -116,7 +116,7 @@ struct dentry *debugfs_create_ptr(const char *name, mode_t mode, */ static ssize_t loader_path_write(struct file *file, const char __user *buf, - size_t len, loff_t *ppos) + size_t len, loff_t *ppos) { ssize_t ret; char *path; @@ -128,20 +128,21 @@ static ssize_t loader_path_write(struct file *file, const char __user *buf, path = kmalloc(len, GFP_KERNEL); if (path == NULL) { - ret = -ENOMEM; - goto out; + return -ENOMEM; } if (copy_from_user(path, buf, len)) { ret = -EINVAL; - goto out; + goto err; } path[len - 1] = '\0'; set_loader_file(path); ret = len; -out: + return ret; +err: + kfree(path); return ret; } diff --git a/preload/preload_pd.c b/preload/preload_pd.c index 628f434..b75dde2 100644 --- a/preload/preload_pd.c +++ b/preload/preload_pd.c @@ -235,13 +235,18 @@ char __user *preload_pd_get_path(struct process_data *pd) /* This function should be called only for current */ struct task_struct *task = current; - unsigned long page = __get_data_page(pd); + unsigned long page = 0; int ret; - if (pd == NULL || page == 0) + if (pd == NULL) + return NULL; + + page = __get_data_page(pd); + + if (page == 0) return NULL; - if (pd->is_mapped == 1) + if (pd->is_mapped == 1) return __get_path(pd); ret = preload_patcher_write_string((void *)page, handlers_info->path, @@ -249,16 +254,16 @@ char __user *preload_pd_get_path(struct process_data *pd) task); if (ret <= 0) { printk(KERN_ERR PRELOAD_PREFIX "Cannot copy string to user!\n"); - goto get_path_failed; + goto get_path_failed; } - pd->is_mapped = 1; + pd->is_mapped = 1; return __get_path(pd); get_path_failed: - return NULL; + return NULL; } @@ -343,25 +348,21 @@ long preload_pd_get_refs(struct process_data *pd) return __get_refcount(pd); } -int preload_pd_create_pd(void** target_place, struct task_struct *task) +int preload_pd_create_pd(void **target_place, struct task_struct *task) { - struct process_data *pd; - unsigned long page = 0; + struct process_data *pd; + unsigned long page = 0; unsigned long base; struct dentry *dentry; - int ret; + int ret = 0; ret = __pd_create_on_demand(); if (ret) - goto create_pd_exit; + return ret; pd = kzalloc(sizeof(*pd), GFP_ATOMIC); - if (pd == NULL) { - ret = -ENOMEM; - goto create_pd_exit; - } - - ret = 0; + if (pd == NULL) + return -ENOMEM; /* 1. check if loader is already mapped */ dentry = preload_debugfs_get_loader_dentry(); @@ -399,7 +400,10 @@ int preload_pd_create_pd(void** target_place, struct task_struct *task) *target_place = pd; + return ret; + create_pd_exit: + kfree(pd); return ret; } diff --git a/preload/preload_threads.c b/preload/preload_threads.c index 360e354..7c881d4 100644 --- a/preload/preload_threads.c +++ b/preload/preload_threads.c @@ -57,13 +57,25 @@ static inline struct preload_td *get_preload_td(struct task_struct *task) unsigned long get_preload_flags(struct task_struct *task) { - return get_preload_td(task)->flags; + struct preload_td *td = get_preload_td(task); + + if (td == NULL) + return 0; + + return td->flags; } void set_preload_flags(struct task_struct *task, unsigned long flags) { - get_preload_td(task)->flags = flags; + struct preload_td *td = get_preload_td(task); + + if (td == NULL) { + printk(KERN_ERR "%s: invalid arguments\n", __FUNCTION__); + return; + } + + td->flags = flags; } @@ -171,6 +183,9 @@ static inline struct thread_slot *__get_task_slot(struct task_struct *task) { struct preload_td *td = get_preload_td(task); + if (td == NULL) + return NULL; + return list_empty(&td->slots) ? NULL : list_last_entry(&td->slots, struct thread_slot, list); } diff --git a/sampler/sampler_hrtimer.c b/sampler/sampler_hrtimer.c index 481791e..c0e669e 100644 --- a/sampler/sampler_hrtimer.c +++ b/sampler/sampler_hrtimer.c @@ -116,5 +116,6 @@ void sampler_timers_stop(int cpu) */ void sampler_timers_set_quantum(unsigned int timer_quantum) { - sampler_timer_quantum = timer_quantum * 1000 * 1000; + u64 tmp = (u64)timer_quantum; + sampler_timer_quantum = tmp * 1000 * 1000; } diff --git a/uprobe/arch/arm/swap-asm/swap_uprobes.h b/uprobe/arch/arm/swap-asm/swap_uprobes.h index 51342af..885f227 100644 --- a/uprobe/arch/arm/swap-asm/swap_uprobes.h +++ b/uprobe/arch/arm/swap-asm/swap_uprobes.h @@ -119,12 +119,16 @@ static inline void swap_put_uarg(struct pt_regs *regs, unsigned long n, switch (n) { case 0: regs->ARM_r0 = val; + break; case 1: regs->ARM_r1 = val; + break; case 2: regs->ARM_r2 = val; + break; case 3: regs->ARM_r3 = val; + break; } ptr = (u32 *)regs->ARM_sp + n - 4; diff --git a/us_manager/debugfs_us_manager.c b/us_manager/debugfs_us_manager.c index 88cb17a..727e4e5 100644 --- a/us_manager/debugfs_us_manager.c +++ b/us_manager/debugfs_us_manager.c @@ -32,7 +32,7 @@ static void on_each_proc_callback(struct sspt_proc *proc, void *data) if (!sspt_proc_is_send_event(proc)) return; - sprintf(pid_str, "%d", proc->tgid); + snprintf(pid_str, sizeof(pid_str), "%d", proc->tgid); len = strlen(pid_str); diff --git a/us_manager/img/img_file.c b/us_manager/img/img_file.c index b21ad73..c670ca7 100644 --- a/us_manager/img/img_file.c +++ b/us_manager/img/img_file.c @@ -110,6 +110,9 @@ int img_file_add_ip(struct img_file *file, unsigned long addr, } ip = create_img_ip(addr, probe_i); + if (ip == NULL) + return -ENOMEM; + img_add_ip_by_list(file, ip); return 0; diff --git a/us_manager/pf/pf_group.c b/us_manager/pf/pf_group.c index f544728..5fb56a3 100644 --- a/us_manager/pf/pf_group.c +++ b/us_manager/pf/pf_group.c @@ -61,6 +61,9 @@ static struct pl_struct *create_pl_struct(struct sspt_proc *proc) { struct pl_struct *pls = kmalloc(sizeof(*pls), GFP_KERNEL); + if (pls == NULL) + return NULL; + INIT_LIST_HEAD(&pls->list); pls->proc = proc; @@ -526,7 +529,8 @@ void check_task_and_install(struct task_struct *task) case PIF_FIRST: case PIF_ADD_PFG: proc = sspt_proc_get_by_task(task); - first_install(task, proc); + if (proc) + first_install(task, proc); break; case PIF_NONE: @@ -552,12 +556,14 @@ void call_page_fault(struct task_struct *task, unsigned long page_addr) case PIF_FIRST: case PIF_ADD_PFG: proc = sspt_proc_get_by_task(task); - first_install(task, proc); + if (proc) + first_install(task, proc); break; case PIF_SECOND: proc = sspt_proc_get_by_task(task); - subsequent_install(task, proc, page_addr); + if (proc) + subsequent_install(task, proc, page_addr); break; case PIF_NONE: diff --git a/us_manager/sspt/sspt.h b/us_manager/sspt/sspt.h index 3199ae7..f3e40e2 100644 --- a/us_manager/sspt/sspt.h +++ b/us_manager/sspt/sspt.h @@ -89,7 +89,8 @@ static inline int sspt_unregister_usprobe(struct task_struct *task, break; case US_DISARM: up = probe_info_get_uprobe(ip->info, ip); - disarm_uprobe(&up->kp, task); + if (up) + disarm_uprobe(&up->kp, task); break; case US_UNINSTALL: probe_info_unregister(ip->info, ip, 0); diff --git a/us_manager/sspt/sspt_feature.c b/us_manager/sspt/sspt_feature.c index 4be4772..bc2c84d 100644 --- a/us_manager/sspt/sspt_feature.c +++ b/us_manager/sspt/sspt_feature.c @@ -92,9 +92,8 @@ struct sspt_feature *sspt_create_feature(void) spin_lock_irqsave(&feature_img_lock, flags); list_for_each_entry(fi, &feature_img_list, list) { fd = create_feature_data(fi); - - /* add to list */ - list_add(&fd->list, &f->feature_list); + if (fd) /* add to list */ + list_add(&fd->list, &f->feature_list); } spin_unlock_irqrestore(&feature_img_lock, flags); } diff --git a/us_manager/sspt/sspt_file.c b/us_manager/sspt/sspt_file.c index 8b88ff0..917335a 100644 --- a/us_manager/sspt/sspt_file.c +++ b/us_manager/sspt/sspt_file.c @@ -50,29 +50,37 @@ static int calculation_hash_bits(int cnt) */ struct sspt_file *sspt_file_create(struct dentry *dentry, int page_cnt) { + int i, table_size; struct sspt_file *obj = kmalloc(sizeof(*obj), GFP_ATOMIC); - if (obj) { - int i, table_size; - INIT_LIST_HEAD(&obj->list); - obj->proc = NULL; - obj->dentry = dentry; - obj->loaded = 0; - obj->vm_start = 0; - obj->vm_end = 0; + if (obj == NULL) + return NULL; + + INIT_LIST_HEAD(&obj->list); + obj->proc = NULL; + obj->dentry = dentry; + obj->loaded = 0; + obj->vm_start = 0; + obj->vm_end = 0; - obj->page_probes_hash_bits = calculation_hash_bits(page_cnt); - table_size = (1 << obj->page_probes_hash_bits); + obj->page_probes_hash_bits = calculation_hash_bits(page_cnt); + table_size = (1 << obj->page_probes_hash_bits); - obj->page_probes_table = + obj->page_probes_table = kmalloc(sizeof(*obj->page_probes_table)*table_size, GFP_ATOMIC); - for (i = 0; i < table_size; ++i) - INIT_HLIST_HEAD(&obj->page_probes_table[i]); - } + if (obj->page_probes_table == NULL) + goto err; + + for (i = 0; i < table_size; ++i) + INIT_HLIST_HEAD(&obj->page_probes_table[i]); return obj; + +err: + kfree(obj); + return NULL; } /** @@ -134,7 +142,8 @@ static struct sspt_page *sspt_find_page_or_new(struct sspt_file *file, if (page == NULL) { page = sspt_page_create(offset); - sspt_add_page(file, page); + if (page) + sspt_add_page(file, page); } return page; @@ -185,7 +194,8 @@ void sspt_file_add_ip(struct sspt_file *file, unsigned long offset, /* FIXME: delete ip */ struct us_ip *ip = create_ip(offset, probe_i, page); - sspt_add_ip(page, ip); + if (page && ip) + sspt_add_ip(page, ip); } /** diff --git a/us_manager/sspt/sspt_proc.c b/us_manager/sspt/sspt_proc.c index 71744a8..88ea025 100644 --- a/us_manager/sspt/sspt_proc.c +++ b/us_manager/sspt/sspt_proc.c @@ -240,7 +240,8 @@ struct sspt_file *sspt_proc_find_file_or_new(struct sspt_proc *proc, file = sspt_proc_find_file(proc, dentry); if (file == NULL) { file = sspt_file_create(dentry, 10); - sspt_proc_add_file(proc, file); + if (file) + sspt_proc_add_file(proc, file); } return file; diff --git a/us_manager/us_slot_manager.c b/us_manager/us_slot_manager.c index 5970514..536d349 100644 --- a/us_manager/us_slot_manager.c +++ b/us_manager/us_slot_manager.c @@ -77,6 +77,10 @@ static void sm_free_us(struct slot_manager *sm, void *ptr) struct slot_manager *create_sm_us(struct task_struct *task) { struct slot_manager *sm = kmalloc(sizeof(*sm), GFP_ATOMIC); + + if (sm == NULL) + return NULL; + sm->slot_size = UPROBES_TRAMP_LEN; sm->alloc = sm_alloc_us; sm->free = sm_free_us; diff --git a/webprobe/webprobe_debugfs.c b/webprobe/webprobe_debugfs.c index d72c4d5..f395ea4 100644 --- a/webprobe/webprobe_debugfs.c +++ b/webprobe/webprobe_debugfs.c @@ -97,7 +97,7 @@ static const struct file_operations fops_enabled = { static ssize_t write_app_info(struct file *file, const char __user *user_buf, size_t count, loff_t *ppos) { - int ret; + int ret = 0; char *buf, *path, *id; int n; @@ -135,7 +135,7 @@ static ssize_t write_app_info(struct file *file, const char __user *user_buf, } web_prof_data_set(path, id); - sprintf(app_info, "%s\n", buf); + snprintf(app_info, sizeof(app_info), "%s\n", buf); free_app_info: kfree(id); diff --git a/writer/debugfs_writer.c b/writer/debugfs_writer.c index 0eb7100..e797abb 100644 --- a/writer/debugfs_writer.c +++ b/writer/debugfs_writer.c @@ -183,8 +183,10 @@ static ssize_t read_filter(struct file *file, char __user *user_buf, ssize_t ret; buf = kmalloc(len + 2, GFP_KERNEL); - memcpy(buf, name, len); + if (buf == NULL) + return -ENOMEM; + memcpy(buf, name, len); buf[len] = '\0'; buf[len + 1] = '\n'; diff --git a/writer/swap_msg.c b/writer/swap_msg.c index 838a30a..f915f6e 100644 --- a/writer/swap_msg.c +++ b/writer/swap_msg.c @@ -189,15 +189,11 @@ int swap_msg_pack_args(char *buf, int len, switch (fmt[fmt_i]) { case 'b': /* 1 byte(bool) */ - if (len < 1) - return -ENOMEM; *buf = (char)!!get_arg(regs, i); buf += 1; len -= 1; break; case 'c': /* 1 byte(char) */ - if (len < 1) - return -ENOMEM; *buf = (char)get_arg(regs, i); buf += 1; len -= 1;