From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933250AbcHDMTo (ORCPT ); Thu, 4 Aug 2016 08:19:44 -0400 Received: from www262.sakura.ne.jp ([202.181.97.72]:29701 "EHLO www262.sakura.ne.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754195AbcHDMTn (ORCPT ); Thu, 4 Aug 2016 08:19:43 -0400 Subject: Re: [PATCH] fs:Fix kmemleak leak warning in getname_flags about working on unitialized memory To: Nicholas Krause , viro@zeniv.linux.org.uk References: <1470260896-31767-1-git-send-email-xerofoify@gmail.com> Cc: akpm@linux-foundation.org, msalter@redhat.com, kuleshovmail@gmail.com, david.vrabel@citrix.com, vbabka@suse.cz, ard.biesheuvel@linaro.org, jgross@suse.com, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org From: Tetsuo Handa Message-ID: Date: Thu, 4 Aug 2016 21:18:19 +0900 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <1470260896-31767-1-git-send-email-xerofoify@gmail.com> Content-Type: text/plain; charset=iso-2022-jp Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2016/08/04 6:48, Nicholas Krause wrote: > This fixes a kmemleak leak warning complaining about working on > unitializied memory as found in the function, getname_flages. Seems > that we are indeed working on unitialized memory, as the filename > char pointer is never made to point to the filname structure's result > member for holding it's name, fix this by using memcpy to copy the > filname structure pointer's, name to the char pointer passed to this > function. > > Signed-off-by: Nicholas Krause > --- > fs/namei.c | 1 + > mm/early_ioremap.c | 1 + > 2 files changed, 2 insertions(+) > > diff --git a/fs/namei.c b/fs/namei.c > index c386a32..6b18d57 100644 > --- a/fs/namei.c > +++ b/fs/namei.c > @@ -196,6 +196,7 @@ getname_flags(const char __user *filename, int flags, int *empty) > } > } > > + memcpy((char *)result->name, filename, len); This filename is a __user pointer. Reading with memcpy() is not safe. > result->uptr = filename; > result->aname = NULL; > audit_getname(result);