diff options
| author | Jesper Juhl <jj@chaosbits.net> | 2010-10-30 18:37:16 +0200 |
|---|---|---|
| committer | Ralf Baechle <ralf@linux-mips.org> | 2010-12-16 18:10:54 +0000 |
| commit | 863abad4f644b6c12bc8176206b35fa7e7cfe1a9 (patch) | |
| tree | cf6aacba2461f8d59b81bb03ca345f0d2270db39 /arch/mips | |
| parent | d62c9ced7ca783e64ff4d9d3d1340cfe2284d47b (diff) | |
| download | kernel_samsung_smdk4412-863abad4f644b6c12bc8176206b35fa7e7cfe1a9.zip kernel_samsung_smdk4412-863abad4f644b6c12bc8176206b35fa7e7cfe1a9.tar.gz kernel_samsung_smdk4412-863abad4f644b6c12bc8176206b35fa7e7cfe1a9.tar.bz2 | |
MIPS: VPE loader: Check vmalloc return value in vpe_open
The return value of the vmalloc() call in arch/mips/kernel/vpe.c::vpe_open()
is not checked, so we potentially store a null pointer in v->pbuffer. Add
a check for a null return and then return -ENOMEM in that case.
[Ralf: The check added by Jesper's original patch is where it logically
should be. Adding it eleminated the need for the checks in a few other
places, so I removed them. There still is a zillion of other things that
need to be fixed in this file / API.]
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/1747/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Diffstat (limited to 'arch/mips')
| -rw-r--r-- | arch/mips/kernel/vpe.c | 14 |
1 files changed, 6 insertions, 8 deletions
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c index 3eb3cde..6a1fdfe 100644 --- a/arch/mips/kernel/vpe.c +++ b/arch/mips/kernel/vpe.c @@ -1092,6 +1092,10 @@ static int vpe_open(struct inode *inode, struct file *filp) /* this of-course trashes what was there before... */ v->pbuffer = vmalloc(P_SIZE); + if (!v->pbuffer) { + pr_warning("VPE loader: unable to allocate memory\n"); + return -ENOMEM; + } v->plen = P_SIZE; v->load_addr = NULL; v->len = 0; @@ -1149,10 +1153,9 @@ static int vpe_release(struct inode *inode, struct file *filp) if (ret < 0) v->shared_ptr = NULL; - // cleanup any temp buffers - if (v->pbuffer) - vfree(v->pbuffer); + vfree(v->pbuffer); v->plen = 0; + return ret; } @@ -1169,11 +1172,6 @@ static ssize_t vpe_write(struct file *file, const char __user * buffer, if (v == NULL) return -ENODEV; - if (v->pbuffer == NULL) { - printk(KERN_ERR "VPE loader: no buffer for program\n"); - return -ENOMEM; - } - if ((count + v->len) > v->plen) { printk(KERN_WARNING "VPE loader: elf size too big. Perhaps strip uneeded symbols\n"); |