[LU-6505] __proc_cpt_table use after free

Related — Tue, 29 Dec 2015 21:53:43 +0000

smatch highlighted this interesting bit in __proc_cpt_table:

        while (1) {
                LIBCFS_ALLOC(buf, len);
                if (buf == NULL)
                        return -ENOMEM;

                rc = cfs_cpt_table_print(cfs_cpt_table, buf, len);
                if (rc >= 0)
                        break;

                LIBCFS_FREE(buf, len);
                if (rc == -EFBIG) {
                        len <<= 1;
                        continue;
                }
                goto out;
        }
...
 out:
        if (buf != NULL)
                LIBCFS_FREE(buf, len);

This is a pretty obvious double free, so we need to move the free near EFBIG into the if branch.

Whamcloud Community JIRA

[LU-6505] __proc_cpt_table use after free