[RESEND] Unsafe kmalloc() calls found

[Oliver Henning <oliver.henning@gmail.com>]

Hello

I have written a Python script to scan the kernel for unchecked kmalloc() calls. It found the following instances. I checked them manually, too. I would like to fix them myself but I do not how to do a proper failure handling. So maybe someone else can have a look.

Oliver


drivers/net/wireless/rsi/rsi_91x_mac80211.c:199
             channels = kmalloc(sizeof(rsi_2ghz_channels), GFP_KERNEL);
             memcpy(channels,
                    rsi_2ghz_channels,
                    sizeof(rsi_2ghz_channels));
---

drivers/net/wireless/rsi/rsi_91x_mac80211.c:208
             channels = kmalloc(sizeof(rsi_5ghz_channels), GFP_KERNEL);
             memcpy(channels,
                    rsi_5ghz_channels,
                    sizeof(rsi_5ghz_channels));
---

arch/mips/pmcs-msp71xx/msp_prom.c:378
          argv = kmalloc(len, GFP_KERNEL);
          ptr = (char *) &argv[prom_argc + 1];    /* strings follow array */
    
          for (argc = 0; argc < prom_argc; argc++) {
               argv[argc] = ptr;
               strcpy(ptr, prom_argv[argc]);
               ptr += strlen(prom_argv[argc]) + 1;
          }
---

arch/mips/pmcs-msp71xx/msp_prom.c:399
          envp = kmalloc(len, GFP_KERNEL);
          ptr = (char *) &envp[i+1];
    
          for (argc = 0; argc < i; argc++) {
               envp[argc] = ptr;
               strcpy(ptr, prom_envp[argc]);
               ptr += strlen(prom_envp[argc]) + 1;
          }
---

arch/powerpc/platforms/pseries/dlpar.c:389
          hp_errlog_copy = kmalloc(sizeof(struct pseries_hp_errorlog),
                          GFP_KERNEL);
          memcpy(hp_errlog_copy, hp_errlog, sizeof(struct pseries_hp_errorlog));
---

drivers/media/pci/cx23885/cx23885-dvb.c:1477
                    fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
                    memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
---

drivers/misc/lkdtm/perms.c:135
          u32 *kmalloc_area = kmalloc(EXEC_SIZE, GFP_KERNEL);
          execute_location(kmalloc_area, CODE_WRITE);
          kfree(kmalloc_area);
     }
---

drivers/gpu/drm/omapdrm/dss/omapdss-boot-init.c:113
          new_compat = kmalloc(new_len, GFP_KERNEL);
    
          omapdss_prefix_strcpy(new_compat, new_len, prop->value, prop->length);
    
          omapdss_update_prop(node, new_compat, new_len);
     }
---

drivers/staging/media/davinci_vpfe/dm365_ipipe.c:1267
               params = kmalloc(sizeof(struct ipipe_module_params),
                          GFP_KERNEL);
               to = (void *)params + module_if->param_offset;
               size = module_if->param_size;
    
               if (to && from && size) {
                    if (copy_from_user(to, (void __user *)from, size)) {
                         rval = -EFAULT;
                         break;
                    }
---

drivers/staging/media/davinci_vpfe/dm365_ipipe.c:1309
               params = kmalloc(sizeof(struct ipipe_module_params),
                          GFP_KERNEL);
               from = (void *)params + module_if->param_offset;
               size = module_if->param_size;
    
               if (to && from && size) {
                    rval = module_if->get(ipipe, from);
                    if (rval)
                         goto error;
                    if (copy_to_user((void __user *)to, from, size)) {
---