Re: [PATCH] mmc: mmc_test: Fix NULL dereference on allocation failure

[Ulf Hansson]

On Tue, 20 Aug 2024 at 10:44, Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
>
> If the "test->highmem = alloc_pages()" allocation fails then calling
> __free_pages(test->highmem) will result in a NULL dereference.  Also
> change the error code to -ENOMEM instead of returning success.
>
> Fixes: 2661081f5ab9 ("mmc_test: highmem tests")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>

Applied for fixes, thanks!

Kind regards
Uffe


> ---
> This code is from 2008 so it must not be that much of an issue in real
> life.
>
>  drivers/mmc/core/mmc_test.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c
> index 8f7f587a0025..b7f627a9fdea 100644
> --- a/drivers/mmc/core/mmc_test.c
> +++ b/drivers/mmc/core/mmc_test.c
> @@ -3125,13 +3125,13 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf,
>         test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL);
>  #ifdef CONFIG_HIGHMEM
>         test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER);
> +       if (!test->highmem) {
> +               count = -ENOMEM;
> +               goto free_test_buffer;
> +       }
>  #endif
>
> -#ifdef CONFIG_HIGHMEM
> -       if (test->buffer && test->highmem) {
> -#else
>         if (test->buffer) {
> -#endif
>                 mutex_lock(&mmc_test_lock);
>                 mmc_test_run(test, testcase);
>                 mutex_unlock(&mmc_test_lock);
> @@ -3139,6 +3139,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf,
>
>  #ifdef CONFIG_HIGHMEM
>         __free_pages(test->highmem, BUFFER_ORDER);
> +free_test_buffer:
>  #endif
>         kfree(test->buffer);
>         kfree(test);
> --
> 2.43.0
>