google / kmsan

KernelMemorySanitizer, a detector of uses of uninitialized memory in the Linux kernel
Other
406 stars 63 forks source link

kmsan: fix kfree() of unallocated memory in kmsan_vmap() #24

Closed nefigtut closed 6 years ago

nefigtut commented 6 years ago

kfree(o_pages) can try to free an unallocated memory in case "if (!s_pages) goto err_free;" and o_pages contains garbage from a stack. fix this by initializing o_pages and s_pages, just in case.

Reported-by: https://syzkaller.appspot.com/bug?id=ae239a8b52cf47d202f7ca93d3e861499f9dffcd Reported-by: https://syzkaller.appspot.com/text?tag=CrashReport&x=104ebce1400000

googlebot commented 6 years ago

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

:memo: Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here (e.g. I signed it!) and we'll verify it.


What to do if you already signed the CLA

Individual signers
Corporate signers
nefigtut commented 6 years ago

I signed it.

googlebot commented 6 years ago

CLAs look good, thanks!

ramosian-glider commented 6 years ago

Vladis, thanks for your patch! Please don't hesitate to send more if you encounter other bugs.