summaryrefslogtreecommitdiffstats
path: root/arch/mips
diff options
context:
space:
mode:
authorJesper Juhl <jj@chaosbits.net>2010-10-30 18:37:16 +0200
committerRalf Baechle <ralf@linux-mips.org>2010-12-16 19:10:54 +0100
commit863abad4f644b6c12bc8176206b35fa7e7cfe1a9 (patch)
treecf6aacba2461f8d59b81bb03ca345f0d2270db39 /arch/mips
parentMIPS: compat: Don't clobber personality bits in 32-bit sys_personality(). (diff)
downloadlinux-863abad4f644b6c12bc8176206b35fa7e7cfe1a9.tar.xz
linux-863abad4f644b6c12bc8176206b35fa7e7cfe1a9.zip
MIPS: VPE loader: Check vmalloc return value in vpe_open
The return value of the vmalloc() call in arch/mips/kernel/vpe.c::vpe_open() is not checked, so we potentially store a null pointer in v->pbuffer. Add a check for a null return and then return -ENOMEM in that case. [Ralf: The check added by Jesper's original patch is where it logically should be. Adding it eleminated the need for the checks in a few other places, so I removed them. There still is a zillion of other things that need to be fixed in this file / API.] Signed-off-by: Jesper Juhl <jj@chaosbits.net> Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/1747/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Diffstat (limited to 'arch/mips')
-rw-r--r--arch/mips/kernel/vpe.c14
1 files changed, 6 insertions, 8 deletions
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
index 3eb3cde2f661..6a1fdfef8fde 100644
--- a/arch/mips/kernel/vpe.c
+++ b/arch/mips/kernel/vpe.c
@@ -1092,6 +1092,10 @@ static int vpe_open(struct inode *inode, struct file *filp)
/* this of-course trashes what was there before... */
v->pbuffer = vmalloc(P_SIZE);
+ if (!v->pbuffer) {
+ pr_warning("VPE loader: unable to allocate memory\n");
+ return -ENOMEM;
+ }
v->plen = P_SIZE;
v->load_addr = NULL;
v->len = 0;
@@ -1149,10 +1153,9 @@ static int vpe_release(struct inode *inode, struct file *filp)
if (ret < 0)
v->shared_ptr = NULL;
- // cleanup any temp buffers
- if (v->pbuffer)
- vfree(v->pbuffer);
+ vfree(v->pbuffer);
v->plen = 0;
+
return ret;
}
@@ -1169,11 +1172,6 @@ static ssize_t vpe_write(struct file *file, const char __user * buffer,
if (v == NULL)
return -ENODEV;
- if (v->pbuffer == NULL) {
- printk(KERN_ERR "VPE loader: no buffer for program\n");
- return -ENOMEM;
- }
-
if ((count + v->len) > v->plen) {
printk(KERN_WARNING
"VPE loader: elf size too big. Perhaps strip uneeded symbols\n");