On Tue, 20 Aug 2024 at 10:44, Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
>
> If the "test->highmem = alloc_pages()" allocation fails then calling
> __free_pages(test->highmem) will result in a NULL dereference. Also
> change the error code to -ENOMEM instead of returning success.
>
> Fixes: 2661081f5ab9 ("mmc_test: highmem tests")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Applied for fixes, thanks!
Kind regards
Uffe
> ---
> This code is from 2008 so it must not be that much of an issue in real
> life.
>
> drivers/mmc/core/mmc_test.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c
> index 8f7f587a0025..b7f627a9fdea 100644
> --- a/drivers/mmc/core/mmc_test.c
> +++ b/drivers/mmc/core/mmc_test.c
> @@ -3125,13 +3125,13 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf,
> test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL);
> #ifdef CONFIG_HIGHMEM
> test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER);
> + if (!test->highmem) {
> + count = -ENOMEM;
> + goto free_test_buffer;
> + }
> #endif
>
> -#ifdef CONFIG_HIGHMEM
> - if (test->buffer && test->highmem) {
> -#else
> if (test->buffer) {
> -#endif
> mutex_lock(&mmc_test_lock);
> mmc_test_run(test, testcase);
> mutex_unlock(&mmc_test_lock);
> @@ -3139,6 +3139,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf,
>
> #ifdef CONFIG_HIGHMEM
> __free_pages(test->highmem, BUFFER_ORDER);
> +free_test_buffer:
> #endif
> kfree(test->buffer);
> kfree(test);
> --
> 2.43.0
>
