| Message ID | 20220213182443.4037039-1-keescook@chromium.org (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 52a9dab6d892763b2a8334a568bd4e2c1a6fde66 |
| Headers | show |
| Series | [v2] tools: Fix use-after-free for realloc(..., 0) | expand |
On Sun, Feb 13, 2022 at 10:24:43AM -0800, Kees Cook wrote: > GCC 12 was correctly reporting a potential use-after-free condition in > the xrealloc helper. Fix the warning by avoiding an implicit "free(ptr)" > when size == 0: > > In file included from help.c:12: > In function 'xrealloc', > inlined from 'add_cmdname' at help.c:24:2: subcmd-util.h:56:23: error: pointer may be used after 'realloc' [-Werror=use-after-free] > 56 | ret = realloc(ptr, size); > | ^~~~~~~~~~~~~~~~~~ > subcmd-util.h:52:21: note: call to 'realloc' here > 52 | void *ret = realloc(ptr, size); > | ^~~~~~~~~~~~~~~~~~ > subcmd-util.h:58:31: error: pointer may be used after 'realloc' [-Werror=use-after-free] > 58 | ret = realloc(ptr, 1); > | ^~~~~~~~~~~~~~~ > subcmd-util.h:52:21: note: call to 'realloc' here > 52 | void *ret = realloc(ptr, size); > | ^~~~~~~~~~~~~~~~~~ > > Reported-by: "Valdis Klētnieks" <valdis.kletnieks@vt.edu> > Fixes: 2f4ce5ec1d44 ("perf tools: Finalize subcmd independence") > Cc: Josh Poimboeuf <jpoimboe@redhat.com> > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > v1: https://lore.kernel.org/lkml/20220212181855.3460176-1-keescook@chromium.org/ > v2: simplify logic (josh) Thanks, running through testing now.
Em Mon, Feb 14, 2022 at 12:07:30PM -0800, Josh Poimboeuf escreveu: > On Sun, Feb 13, 2022 at 10:24:43AM -0800, Kees Cook wrote: > > GCC 12 was correctly reporting a potential use-after-free condition in > > the xrealloc helper. Fix the warning by avoiding an implicit "free(ptr)" > > when size == 0: > > > > In file included from help.c:12: > > In function 'xrealloc', > > inlined from 'add_cmdname' at help.c:24:2: subcmd-util.h:56:23: error: pointer may be used after 'realloc' [-Werror=use-after-free] > > 56 | ret = realloc(ptr, size); > > | ^~~~~~~~~~~~~~~~~~ > > subcmd-util.h:52:21: note: call to 'realloc' here > > 52 | void *ret = realloc(ptr, size); > > | ^~~~~~~~~~~~~~~~~~ > > subcmd-util.h:58:31: error: pointer may be used after 'realloc' [-Werror=use-after-free] > > 58 | ret = realloc(ptr, 1); > > | ^~~~~~~~~~~~~~~ > > subcmd-util.h:52:21: note: call to 'realloc' here > > 52 | void *ret = realloc(ptr, size); > > | ^~~~~~~~~~~~~~~~~~ > > > > Reported-by: "Valdis Klētnieks" <valdis.kletnieks@vt.edu> > > Fixes: 2f4ce5ec1d44 ("perf tools: Finalize subcmd independence") > > Cc: Josh Poimboeuf <jpoimboe@redhat.com> > > Signed-off-by: Kees Cook <keescook@chromium.org> > > --- > > v1: https://lore.kernel.org/lkml/20220212181855.3460176-1-keescook@chromium.org/ > > v2: simplify logic (josh) > > Thanks, running through testing now. I assume that testing went ok, may I add a Tested-by: you? - Arnaldo
On Sun, Feb 13, 2022 at 10:24:43AM -0800, Kees Cook wrote: > GCC 12 was correctly reporting a potential use-after-free condition in > the xrealloc helper. Fix the warning by avoiding an implicit "free(ptr)" > when size == 0: > > In file included from help.c:12: > In function 'xrealloc', > inlined from 'add_cmdname' at help.c:24:2: subcmd-util.h:56:23: error: pointer may be used after 'realloc' [-Werror=use-after-free] > 56 | ret = realloc(ptr, size); > | ^~~~~~~~~~~~~~~~~~ > subcmd-util.h:52:21: note: call to 'realloc' here > 52 | void *ret = realloc(ptr, size); > | ^~~~~~~~~~~~~~~~~~ > subcmd-util.h:58:31: error: pointer may be used after 'realloc' [-Werror=use-after-free] > 58 | ret = realloc(ptr, 1); > | ^~~~~~~~~~~~~~~ > subcmd-util.h:52:21: note: call to 'realloc' here > 52 | void *ret = realloc(ptr, size); > | ^~~~~~~~~~~~~~~~~~ > > Reported-by: "Valdis Klētnieks" <valdis.kletnieks@vt.edu> > Fixes: 2f4ce5ec1d44 ("perf tools: Finalize subcmd independence") > Cc: Josh Poimboeuf <jpoimboe@redhat.com> > Signed-off-by: Kees Cook <keescook@chromium.org> Tested this patch with the Fedora rawhide builds, and this does indeed fix the issue. Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
On Tue, Feb 15, 2022 at 05:42:35PM -0300, Arnaldo Carvalho de Melo wrote: > Em Mon, Feb 14, 2022 at 12:07:30PM -0800, Josh Poimboeuf escreveu: > > On Sun, Feb 13, 2022 at 10:24:43AM -0800, Kees Cook wrote: > > > GCC 12 was correctly reporting a potential use-after-free condition in > > > the xrealloc helper. Fix the warning by avoiding an implicit "free(ptr)" > > > when size == 0: > > > > > > In file included from help.c:12: > > > In function 'xrealloc', > > > inlined from 'add_cmdname' at help.c:24:2: subcmd-util.h:56:23: error: pointer may be used after 'realloc' [-Werror=use-after-free] > > > 56 | ret = realloc(ptr, size); > > > | ^~~~~~~~~~~~~~~~~~ > > > subcmd-util.h:52:21: note: call to 'realloc' here > > > 52 | void *ret = realloc(ptr, size); > > > | ^~~~~~~~~~~~~~~~~~ > > > subcmd-util.h:58:31: error: pointer may be used after 'realloc' [-Werror=use-after-free] > > > 58 | ret = realloc(ptr, 1); > > > | ^~~~~~~~~~~~~~~ > > > subcmd-util.h:52:21: note: call to 'realloc' here > > > 52 | void *ret = realloc(ptr, size); > > > | ^~~~~~~~~~~~~~~~~~ > > > > > > Reported-by: "Valdis Klētnieks" <valdis.kletnieks@vt.edu> > > > Fixes: 2f4ce5ec1d44 ("perf tools: Finalize subcmd independence") > > > Cc: Josh Poimboeuf <jpoimboe@redhat.com> > > > Signed-off-by: Kees Cook <keescook@chromium.org> > > > --- > > > v1: https://lore.kernel.org/lkml/20220212181855.3460176-1-keescook@chromium.org/ > > > v2: simplify logic (josh) > > > > Thanks, running through testing now. > > I assume that testing went ok, may I add a Tested-by: you? Yes, feel free to add: Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
diff --git a/tools/lib/subcmd/subcmd-util.h b/tools/lib/subcmd/subcmd-util.h index 794a375dad36..b2aec04fce8f 100644 --- a/tools/lib/subcmd/subcmd-util.h +++ b/tools/lib/subcmd/subcmd-util.h @@ -50,15 +50,8 @@ static NORETURN inline void die(const char *err, ...) static inline void *xrealloc(void *ptr, size_t size) { void *ret = realloc(ptr, size); - if (!ret && !size) - ret = realloc(ptr, 1); - if (!ret) { - ret = realloc(ptr, size); - if (!ret && !size) - ret = realloc(ptr, 1); - if (!ret) - die("Out of memory, realloc failed"); - } + if (!ret) + die("Out of memory, realloc failed"); return ret; }
GCC 12 was correctly reporting a potential use-after-free condition in the xrealloc helper. Fix the warning by avoiding an implicit "free(ptr)" when size == 0: In file included from help.c:12: In function 'xrealloc', inlined from 'add_cmdname' at help.c:24:2: subcmd-util.h:56:23: error: pointer may be used after 'realloc' [-Werror=use-after-free] 56 | ret = realloc(ptr, size); | ^~~~~~~~~~~~~~~~~~ subcmd-util.h:52:21: note: call to 'realloc' here 52 | void *ret = realloc(ptr, size); | ^~~~~~~~~~~~~~~~~~ subcmd-util.h:58:31: error: pointer may be used after 'realloc' [-Werror=use-after-free] 58 | ret = realloc(ptr, 1); | ^~~~~~~~~~~~~~~ subcmd-util.h:52:21: note: call to 'realloc' here 52 | void *ret = realloc(ptr, size); | ^~~~~~~~~~~~~~~~~~ Reported-by: "Valdis Klētnieks" <valdis.kletnieks@vt.edu> Fixes: 2f4ce5ec1d44 ("perf tools: Finalize subcmd independence") Cc: Josh Poimboeuf <jpoimboe@redhat.com> Signed-off-by: Kees Cook <keescook@chromium.org> --- v1: https://lore.kernel.org/lkml/20220212181855.3460176-1-keescook@chromium.org/ v2: simplify logic (josh) --- tools/lib/subcmd/subcmd-util.h | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)