Re: [PATCH] kunit: string-stream: Fix a UAF bug in kunit_init_suite()

2024-11-11 Thread Jinjie Ruan
On 2024/11/9 20:40, Kuan-Wei Chiu wrote: > Hi Jinjie, > > On Thu, Oct 24, 2024 at 05:43:03PM +0800, Jinjie Ruan wrote: >> In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the >> kunit_suite_for_each_test_case() loop, the "suite->log = stream" >> has assigned before, and the er

Re: [PATCH] kunit: string-stream: Fix a UAF bug in kunit_init_suite()

2024-11-11 Thread Jinjie Ruan
On 2024/11/9 21:02, Kuan-Wei Chiu wrote: > On Sat, Nov 09, 2024 at 08:40:30PM +0800, Kuan-Wei Chiu wrote: >> Hi Jinjie, >> >> On Thu, Oct 24, 2024 at 05:43:03PM +0800, Jinjie Ruan wrote: >>> In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the >>> kunit_suite_for_each_test_case

Re: [PATCH] kunit: string-stream: Fix a UAF bug in kunit_init_suite()

2024-11-09 Thread Kuan-Wei Chiu
On Sat, Nov 09, 2024 at 08:40:30PM +0800, Kuan-Wei Chiu wrote: > Hi Jinjie, > > On Thu, Oct 24, 2024 at 05:43:03PM +0800, Jinjie Ruan wrote: > > In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the > > kunit_suite_for_each_test_case() loop, the "suite->log = stream" > > has assig

Re: [PATCH] kunit: string-stream: Fix a UAF bug in kunit_init_suite()

2024-11-09 Thread Kuan-Wei Chiu
Hi Jinjie, On Thu, Oct 24, 2024 at 05:43:03PM +0800, Jinjie Ruan wrote: > In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the > kunit_suite_for_each_test_case() loop, the "suite->log = stream" > has assigned before, and the error path only free the suite->log's stream > memory b

Re: [PATCH] kunit: string-stream: Fix a UAF bug in kunit_init_suite()

2024-11-09 Thread David Gow
On Thu, 24 Oct 2024 at 17:43, Jinjie Ruan wrote: > > In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the > kunit_suite_for_each_test_case() loop, the "suite->log = stream" > has assigned before, and the error path only free the suite->log's stream > memory but not set it to NULL

Re: [PATCH] kunit: string-stream: Fix a UAF bug in kunit_init_suite()

2024-11-06 Thread Jinjie Ruan
Gentle Ping. On 2024/10/24 17:43, Jinjie Ruan wrote: > In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the > kunit_suite_for_each_test_case() loop, the "suite->log = stream" > has assigned before, and the error path only free the suite->log's stream > memory but not set it to NU

[PATCH] kunit: string-stream: Fix a UAF bug in kunit_init_suite()

2024-10-24 Thread Jinjie Ruan
In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the kunit_suite_for_each_test_case() loop, the "suite->log = stream" has assigned before, and the error path only free the suite->log's stream memory but not set it to NULL in string_stream_destroy(), so the later string_stream_clea