Hi All,
Enclosed are 24 bugs where code uses memory that has been freed. The
good thing about these bugs is that they are easy to fix. (Note: About
5 of these have had patches submitted, so this list is a bit out of
date.)
Summary
2.4.4ac8-specific errors = 4
2.4.4-specific errors = 5
Common errors = 15
Total = 24
Dawson
# BUGs | File Name
3 | drivers/char/rio/rio_linux.c
3 | drivers/atm/iphase.c
2 | drivers/usb/dc2xx.c
2 | drivers/block/cciss.c
1 | drivers/char/drm/gamma_dma.c
1 | fs/proc/generic.c
1 | drivers/isdn/isdn_ppp.c
1 | net/ax25/ax25_ip.c
1 | drivers/net/wan/lapbether.c
1 | drivers/usb/serial/io_edgeport.c
1 | net/netrom/nr_dev.c
1 | drivers/i2o/i2o_pci.c
1 | drivers/sound/cs4281/cs4281m.c
1 | drivers/net/hamradio/bpqether.c
1 | net/ipv6/udp.c
1 | net/wanrouter/wanmain.c
1 | drivers/net/irda/nsc-ircc.c
1 | drivers/sound/cs46xx.c
----------------------------------------------------------------------
Boilerplate disclaimer:
- this is part of a one-time large batch of errors. In the future,
we'll send out incremental bug reports along with a pointer to
the bug database on our website.
- as always, bugs may not be errors --- we have inspected the
error logs to counter this.
- bugs may be missing in one distribution versus the other because
we did not compile that file (or failed to fully compile it).
It can be worthwhile to cross check important bugs to make sure
they've been killed.
- sorted roughly by severity and ease-of-diagnosis. The highest
ranked bugs are "SECURITY" which (in most of the examples)
are primarily denial-of-service vulnerabilities where the user
could trigger the bug when they canted to. Ease-of-diagnosis
is currently crude: we rank LOCAL errors over GLOBAL (GLOBAL
require looking at call chains) and then distance between
error source and manifestation as the next (closer is better)
- if a version if one of the version has no errors specific to it,
this can just be because we did not inspect all the error reports.
These are typically from checkers that required some inter-function
inspection. If you are interested in these errors, send us mail,,
and we can send you the unispected file.
############################################################
# 2.4.4ac8 specific errors
#
---------------------------------------------------------
[BUG] [fixed in 2.4.4]
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/block/cciss.c:686:cciss_ioctl: ERROR:FREE:682:686: WARN: Use-after-free of "c"! set by 'cmd_free':682 [type=SECURITY]
{
/* Copy the data out of the buffer we created */
if (copy_to_user(iocommand.buf, buff, iocommand.buf_size))
{
kfree(buff);
Start --->
cmd_free(h, c, 0);
}
}
kfree(buff);
Error --->
cmd_free(h, c, 0);
return(0);
}
---------------------------------------------------------
[BUG] [fixed in 2.4.4]
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/block/cciss.c:685:cciss_ioctl: ERROR:FREE:681:685: WARN: Use-after-free of "buff"! set by 'kfree':681 [type=SECURITY]
if (iocommand.Request.Type.Direction == XFER_READ)
{
/* Copy the data out of the buffer we created */
if (copy_to_user(iocommand.buf, buff, iocommand.buf_size))
{
Start --->
kfree(buff);
cmd_free(h, c, 0);
}
}
Error --->
kfree(buff);
cmd_free(h, c, 0);
return(0);
}
---------------------------------------------------------
[BUG] Looks pretty bad
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/usb/dc2xx.c:473:camera_disconnect: ERROR:FREE:466:473: WARN: Use-after-free of "camera"! set by 'kfree':466
/* If camera's not opened, we can clean up right away.
* Else apps see a disconnect on next I/O; the release cleans.
*/
if (!camera->buf) {
minor_data [subminor] = NULL;
Start --->
kfree (camera);
} else
camera->dev = NULL;
info ("USB Camera #%d disconnected", subminor);
usb_dec_dev_use (dev);
Error --->
up (&camera->sem);
up (&state_table_mutex);
}
---------------------------------------------------------
[BUG] seems possible --- or is some precondition guarenteed?
/u2/engler/mc/oses/linux/2.4.4-ac8/net/ipv6/udp.c:438:udpv6_recvmsg: ERROR:FREE:453:438: WARN: Use-after-free of "skb"! set by 'kfree_skb':453
}
}
err = copied;
out_free:
Error --->
skb_free_datagram(sk, skb);
... DELETED 9 lines ...
__skb_unlink(skb, &sk->receive_queue);
clear = 1;
}
spin_unlock_irq(&sk->receive_queue.lock);
if (clear)
Start --->
kfree_skb(skb);
}
/* Error for blocking case is chosen to masquerade
############################################################
# 2.4.4 specific errors
#
---------------------------------------------------------
[BUG] [fixed in ac8]
/u2/engler/mc/oses/linux/2.4.4/drivers/net/irda/nsc-ircc.c:319:nsc_ircc_open: ERROR:FREE:318:319: WARN: Use-after-free of "self"! set by 'kfree':318
memset(self->rx_buff.head, 0, self->rx_buff.truesize);
self->tx_buff.head = (__u8 *) kmalloc(self->tx_buff.truesize,
GFP_KERNEL|GFP_DMA);
if (self->tx_buff.head == NULL) {
Start --->
kfree(self);
Error --->
kfree(self->rx_buff.head);
return -ENOMEM;
}
memset(self->tx_buff.head, 0, self->tx_buff.truesize);
---------------------------------------------------------
[BUG] BAD
/u2/engler/mc/oses/linux/2.4.4/drivers/sound/cs46xx.c:5324:cs46xx_remove: ERROR:FREE:5322:5324: WARN: Use-after-free of "card"! set by 'kfree':5322
kfree (card->ac97_codec[i]);
}
unregister_sound_dsp(card->dev_audio);
if(card->dev_midi)
unregister_sound_midi(card->dev_midi);
Start --->
kfree(card);
PCI_SET_DRIVER_DATA(pci_dev,NULL);
Error --->
list_del(&card->list);
CS_DBGOUT(CS_INIT | CS_FUNCTION, 2, printk(KERN_INFO
"cs46xx: cs46xx_remove()-: remove successful\n"));
---------------------------------------------------------
[BUG] [BAD] Seems like a really really bad double free.
/u2/engler/mc/oses/linux/2.4.4/drivers/i2o/i2o_pci.c:231:i2o_pci_install: ERROR:FREE:229:231: WARN: Use-after-free of "c"! set by 'i2o_delete_controller':229
c->name, dev->irq);
c->bus.pci.irq = -1;
#ifdef MODULE
core->delete(c);
#else
Start --->
i2o_delete_controller(c);
#endif /* MODULE */
Error --->
kfree(c);
iounmap(mem);
return -EBUSY;
}
---------------------------------------------------------
[BUG] [BAD] Returns a freed pointer -- very very bad.
/u2/engler/mc/oses/linux/2.4.4/fs/proc/generic.c:438:proc_symlink: ERROR:FREE:430:438: WARN: Use-after-free of "ent"! set by 'kfree':430
ent->namelen = len;
ent->nlink = 1;
ent->mode = S_IFLNK|S_IRUGO|S_IWUGO|S_IXUGO;
ent->data = kmalloc((ent->size=strlen(dest))+1, GFP_KERNEL);
if (!ent->data) {
Start --->
kfree(ent);
goto out;
}
strcpy((char*)ent->data,dest);
proc_register(parent, ent);
out:
Error --->
return ent;
}
struct proc_dir_entry *proc_mknod(const char *name, mode_t mode,
############################################################
# errors common to both
#
---------------------------------------------------------
[BUG] [GEM] horrible horrible bug.
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/isdn/isdn_ppp.c:822:isdn_ppp_init: ERROR:FREE:822:822: WARN: Use-after-free of "ippp_table"! set by 'kfree':822
for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
if (!(ippp_table[i] = (struct ippp_struct *)
kmalloc(sizeof(struct ippp_struct), GFP_KERNEL))) {
printk(KERN_WARNING "isdn_ppp_init: Could not alloc ippp_table\n");
for (j = 0; j < i; j++)
Error --->
kfree(ippp_table[i]);
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/atm/iphase.c:1323:rx_dle_intr: ERROR:FREE:1321:1323: WARN: Use-after-free of "skb"! set by 'dev_kfree_skb_any':1321
}
ia_vcc = INPH_IA_VCC(vcc);
if (ia_vcc == NULL)
{
atomic_inc(&vcc->stats->rx_err);
Start --->
dev_kfree_skb_any(skb);
#if LINUX_VERSION_CODE >= 0x20312
Error --->
atm_return(vcc, atm_guess_pdu2truesize(skb->len));
#else
atm_return(vcc, atm_pdu2truesize(skb->len));
#endif
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/atm/iphase.c:1339:rx_dle_intr: ERROR:FREE:1337:1339: WARN: Use-after-free of "skb"! set by 'dev_kfree_skb_any':1337
length = swap(trailer->length);
if ((length > iadev->rx_buf_sz) || (length >
(skb->len - sizeof(struct cpcs_trailer))))
{
atomic_inc(&vcc->stats->rx_err);
Start --->
dev_kfree_skb_any(skb);
IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
Error --->
length, skb->len);)
#if LINUX_VERSION_CODE >= 0x20312
atm_return(vcc, atm_guess_pdu2truesize(skb->len));
#else
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/sound/cs4281/cs4281m.c:4468:cs4281_remove: ERROR:FREE:4466:4468: WARN: Use-after-free of "s"! set by 'kfree':4466
unregister_sound_dsp(s->dev_audio);
unregister_sound_mixer(s->dev_mixer);
unregister_sound_midi(s->dev_midi);
iounmap(s->pBA1);
iounmap(s->pBA0);
Start --->
kfree(s);
pci_set_drvdata(pci_dev,NULL);
Error --->
list_del(&s->list);
CS_DBGOUT(CS_INIT | CS_FUNCTION, 2, printk(KERN_INFO
"cs4281: cs4281_remove()-: remove successful\n"));
}
---------------------------------------------------------
[BUG] Again assumes kfree sets memory to NULL.
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/net/wan/lapbether.c:116:lapbeth_check_devices: ERROR:FREE:113:116: WARN: Use-after-free of "lapbeth"! set by 'kfree':113
if (&lapbeth->axdev == dev)
result = 1;
unregister_netdev(&lapbeth->axdev);
dev_put(lapbeth->ethdev);
Start --->
kfree(lapbeth);
}
Error --->
lapbeth_prev = lapbeth;
}
restore_flags(flags);
---------------------------------------------------------
[BUG] bpq is freed, assigned to another variable (bpq_prev), then
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/net/hamradio/bpqether.c:196:bpq_check_devices: ERROR:FREE:193:196: WARN: Use-after-free of "bpq"! set by 'kfree':193
/* We should be locked, call
* unregister_netdevice directly
*/
unregister_netdevice(&bpq->axdev);
Start --->
kfree(bpq);
}
Error --->
bpq_prev = bpq;
}
restore_flags(flags);
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/net/wanrouter/wanmain.c:617:device_setup: ERROR:FREE:614:617: WARN: Use-after-free of "conf"! set by 'kfree':614
return -EINVAL;
}
if (conf->data_size && conf->data){
if(conf->data_size > 128000 || conf->data_size < 0) {
Start --->
kfree(conf);
printk(KERN_INFO
"%s: ERROR, Invalid firmware data size %i !\n",
Error --->
wandev->name, conf->data_size);
return -EINVAL;;
}
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/atm/iphase.c:1341:rx_dle_intr: ERROR:FREE:1337:1341: WARN: Use-after-free of "skb"! set by 'dev_kfree_skb_any':1337
length = swap(trailer->length);
if ((length > iadev->rx_buf_sz) || (length >
(skb->len - sizeof(struct cpcs_trailer))))
{
atomic_inc(&vcc->stats->rx_err);
Start --->
dev_kfree_skb_any(skb);
IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
length, skb->len);)
#if LINUX_VERSION_CODE >= 0x20312
Error --->
atm_return(vcc, atm_guess_pdu2truesize(skb->len));
#else
atm_return(vcc, atm_pdu2truesize(skb->len));
#endif
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/net/netrom/nr_dev.c:122:nr_rebuild_header: ERROR:FREE:117:122: WARN: Use-after-free of "skbn"! set by 'kfree_skb':117
skb_set_owner_w(skbn, skb->sk);
kfree_skb(skb);
if (!nr_route_frame(skbn, NULL)) {
Start --->
kfree_skb(skbn);
stats->tx_errors++;
}
stats->tx_packets++;
Error --->
stats->tx_bytes += skbn->len;
return 1;
}
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/net/ax25/ax25_ip.c:163:ax25_rebuild_header: ERROR:FREE:157:163: WARN: Use-after-free of "skb"! set by 'kfree_skb':157
}
if (skb->sk != NULL)
skb_set_owner_w(ourskb, skb->sk);
Start --->
kfree_skb(skb);
src_c = *src;
dst_c = *dst;
skb_pull(ourskb, AX25_HEADER_LEN - 1); /* Keep PID */
Error --->
skb->nh.raw = skb->data;
ax25_send_frame(ourskb, ax25_dev->values[AX25_VALUES_PACLEN], &src_c,
&dst_c, route->digipeat, dev);
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/usb/serial/io_edgeport.c:944:edge_bulk_out_cmd_callback: ERROR:FREE:937:944: WARN: Use-after-free of "urb"! set by 'usb_free_urb':937
kfree(urb->transfer_buffer);
}
// Free the command urb
usb_unlink_urb (urb);
Start --->
usb_free_urb (urb);
if (port_paranoia_check (edge_port->port, __FUNCTION__)) {
return;
}
if (status) {
Error --->
dbg(__FUNCTION__" - nonzero write bulk status received: %d", urb->status);
return;
}
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/char/drm/gamma_dma.c:573:gamma_dma_send_buffers: ERROR:FREE:561:573: WARN: Use-after-free of "last_buf"! set by 'drm_free_buffer':561
DRM_DEBUG("%d running\n", current->pid);
remove_wait_queue(&last_buf->dma_wait, &entry);
if (!retcode
|| (last_buf->list==DRM_LIST_PEND && !last_buf->pending)) {
if (!waitqueue_active(&last_buf->dma_wait)) {
Start --->
drm_free_buffer(dev, last_buf);
}
}
if (retcode) {
DRM_ERROR("ctx%d w%d p%d c%d i%d l%d %d/%d\n",
d->context,
last_buf->waiting,
last_buf->pending,
DRM_WAITCOUNT(dev, d->context),
last_buf->idx,
last_buf->list,
last_buf->pid,
Error --->
current->pid);
}
}
return retcode;
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/usb/dc2xx.c:332:camera_release: ERROR:FREE:330:332: WARN: Use-after-free of "camera"! set by 'kfree':330
subminor = camera->subminor;
/* If camera was unplugged with open file ... */
if (!camera->dev) {
minor_data [subminor] = NULL;
Start --->
kfree (camera);
}
Error --->
up (&camera->sem);
up (&state_table_mutex);
dbg ("close #%d", subminor);
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/char/rio/rio_linux.c:1036:rio_init_datastructures: ERROR:FREE:1031:1036: WARN: Use-after-free of "RIOHosts"! set by 'kfree':1031
kfree (p->RIOPortp[i]);
/*free5: */
kfree (rio_termios_locked);
free4:kfree (rio_termios);
free3:kfree (p->RIOPortp);
Start --->
free2:kfree (p->RIOHosts);
free1:kfree (p);
free0:
if (p) {
rio_dprintk (RIO_DEBUG_INIT, "Not enough memory! %p %p %p %p %p\n",
Error --->
p, p->RIOHosts, p->RIOPortp, rio_termios, rio_termios);
}
return -ENOMEM;
}
---------------------------------------------------------
[BUG]
/u2/engler/mc/oses/linux/2.4.4-ac8/drivers/char/rio/rio_linux.c:1036:rio_init_datastructures: ERROR:FREE:1030:1036: WARN: Use-after-free of "RIOPortp"! set by 'kfree':1030
free6:for (i--;i>=0;i--)
kfree (p->RIOPortp[i]);
/*free5: */
kfree (rio_termios_locked);
free4:kfree (rio_termios);
Start --->
free3:kfree (p->RIOPortp);
free2:kfree (p->RIOHosts);
free1:kfree (p);
free0:
if (p) {
rio_dprintk (RIO_DEBUG_INIT, "Not enough memory! %p %p %p %p %p\n",
Error --->
p, p->RIOHosts, p->RIOPortp, rio_termios, rio_termios);
}
return -ENOMEM;
}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Thu May 31 2001 - 21:00:19 EST