| Message ID | 20220424211536.1373878-1-colin.i.king@gmail.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | selftests/resctrl: Fix null pointer dereference on open failed | expand |
On 4/24/22 3:15 PM, Colin Ian King wrote: > Currently if opening /dev/null fails to open then file pointer fp > is null and further access to fp via fprintf will cause a null > pointer dereference. Fix this by returning a negative error value > when a null fp is detected. > How did you find this problem and how can it be reproduced? Is there a case where test fails to open "/dev/null"? > Fixes: a2561b12fe39 ("selftests/resctrl: Add built in benchmark") > Signed-off-by: Colin Ian King <colin.i.king@gmail.com> > --- > tools/testing/selftests/resctrl/fill_buf.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c > index 51e5cf22632f..56ccbeae0638 100644 > --- a/tools/testing/selftests/resctrl/fill_buf.c > +++ b/tools/testing/selftests/resctrl/fill_buf.c > @@ -121,8 +121,10 @@ static int fill_cache_read(unsigned char *start_ptr, unsigned char *end_ptr, > > /* Consume read result so that reading memory is not optimized out. */ > fp = fopen("/dev/null", "w"); > - if (!fp) > + if (!fp) { > perror("Unable to write to /dev/null"); > + return -1; > + } > fprintf(fp, "Sum: %d ", ret); > fclose(fp); > > thanks, -- Shuah
On 25/04/2022 16:51, Shuah Khan wrote: > On 4/24/22 3:15 PM, Colin Ian King wrote: >> Currently if opening /dev/null fails to open then file pointer fp >> is null and further access to fp via fprintf will cause a null >> pointer dereference. Fix this by returning a negative error value >> when a null fp is detected. >> > > How did you find this problem and how can it be reproduced? Is there > a case where test fails to open "/dev/null"? Found with static analysis, cppcheck. Open on /dev/null is unlikely to fail, but it's good to fail reliably rather than have a SIGSEGV :-) Colin > >> Fixes: a2561b12fe39 ("selftests/resctrl: Add built in benchmark") >> Signed-off-by: Colin Ian King <colin.i.king@gmail.com> >> --- >> tools/testing/selftests/resctrl/fill_buf.c | 4 +++- >> 1 file changed, 3 insertions(+), 1 deletion(-) >> >> diff --git a/tools/testing/selftests/resctrl/fill_buf.c >> b/tools/testing/selftests/resctrl/fill_buf.c >> index 51e5cf22632f..56ccbeae0638 100644 >> --- a/tools/testing/selftests/resctrl/fill_buf.c >> +++ b/tools/testing/selftests/resctrl/fill_buf.c >> @@ -121,8 +121,10 @@ static int fill_cache_read(unsigned char >> *start_ptr, unsigned char *end_ptr, >> /* Consume read result so that reading memory is not optimized >> out. */ >> fp = fopen("/dev/null", "w"); >> - if (!fp) >> + if (!fp) { >> perror("Unable to write to /dev/null"); >> + return -1; >> + } >> fprintf(fp, "Sum: %d ", ret); >> fclose(fp); >> > > thanks, > -- Shuah
On 4/25/22 10:06 AM, Colin King (gmail) wrote: > On 25/04/2022 16:51, Shuah Khan wrote: >> On 4/24/22 3:15 PM, Colin Ian King wrote: >>> Currently if opening /dev/null fails to open then file pointer fp >>> is null and further access to fp via fprintf will cause a null >>> pointer dereference. Fix this by returning a negative error value >>> when a null fp is detected. >>> >> >> How did you find this problem and how can it be reproduced? Is there >> a case where test fails to open "/dev/null"? > > Found with static analysis, cppcheck. Open on /dev/null is unlikely to fail, but it's good to fail reliably rather than have a SIGSEGV :-) > I don't see how /dev/null open could fail here in this test. However, I will take this fix. Please add information how you found it and include the cppheck log in the commit log and send me v2. thanks, -- Shuah
diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c index 51e5cf22632f..56ccbeae0638 100644 --- a/tools/testing/selftests/resctrl/fill_buf.c +++ b/tools/testing/selftests/resctrl/fill_buf.c @@ -121,8 +121,10 @@ static int fill_cache_read(unsigned char *start_ptr, unsigned char *end_ptr, /* Consume read result so that reading memory is not optimized out. */ fp = fopen("/dev/null", "w"); - if (!fp) + if (!fp) { perror("Unable to write to /dev/null"); + return -1; + } fprintf(fp, "Sum: %d ", ret); fclose(fp);
Currently if opening /dev/null fails to open then file pointer fp is null and further access to fp via fprintf will cause a null pointer dereference. Fix this by returning a negative error value when a null fp is detected. Fixes: a2561b12fe39 ("selftests/resctrl: Add built in benchmark") Signed-off-by: Colin Ian King <colin.i.king@gmail.com> --- tools/testing/selftests/resctrl/fill_buf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)