Skip to content

AP_RangeFinder: Possible NULL pointer dereference#8783

Closed
KimHyungSub wants to merge 3 commits intoArduPilot:masterfrom
KimHyungSub:master
Closed

AP_RangeFinder: Possible NULL pointer dereference#8783
KimHyungSub wants to merge 3 commits intoArduPilot:masterfrom
KimHyungSub:master

Conversation

@KimHyungSub
Copy link
Copy Markdown
Contributor

Issues: #8764
I correct these issues and then open a pull request.
Please check if the code is correct or not.

Possible NULL pointer dereference in libraries/AP_RangeFinder/AP_RangeFinder_BBB_PRU.cpp
@peterbarker
Copy link
Copy Markdown
Contributor

Wow. This is a doozy - well spotted.

There are several problems here which your PR doesn't address. Most notably memfd isn't checked for being -1, ctrl for and ram being nullptr. Additionally, your fix may mean file descriptors are leaked in the case of a failed read.

There are enough resources involved here that I think a goto CLEANUP pattern is warranted. i.e. if an error is detected then you goto a cleanup block at the bottom of the function which releases resources, falling through multiple labels as you progressively allocate resources.

(minor cleanup at the same time: don't pre-declare variables at the top, declare when defining, ie.e. uint32_t memfd = ...)

Are you happy to chase this more-complete cleanup down?

@rmackay9
Copy link
Copy Markdown
Contributor

rmackay9 commented Jul 1, 2018

@KimHyungSub, it's great that you're finding these issues! nicely done!

@KimHyungSub
Copy link
Copy Markdown
Contributor Author

@peterbarker Ah! you are right! I ignore other parts without the file descriptor.

ram = mmap(0, PRU0_IRAM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, mem_fd, PRU0_IRAM_BASE);

uint32_t mem_fd = open("/dev/mem", O_RDWR | O_SYNC | O_CLOEXEC);
if(mem_fd == -1)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style-guide requires that the brace goes on the same line as the if, and a space between the if and the pren.

uint32_t mem_fd = open("/dev/mem", O_RDWR | O_SYNC | O_CLOEXEC);
if(mem_fd == -1)
{
return false;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For consistency, create a label for this case, too.

uint32_t *ctrl = (uint32_t*)mmap(0, 0x1000, PROT_READ | PROT_WRITE, MAP_SHARED, mem_fd, PRU0_CTRL_BASE);
if(ctrl == nullptr)
{
goto fail_mmap;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FAIL_MMAP_CTRL

void *ram = mmap(0, PRU0_IRAM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, mem_fd, PRU0_IRAM_BASE);
if(ram == nullptr)
{
goto fail_mmap;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FAIL_MMAP_IRAM

}

if(fread(ram, PRU0_IRAM_SIZE, 1, file) != 1)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extraneous whitespace; see if you can turn on "show trailing whitespace" in your editor.


if(fread(ram, PRU0_DRAM_SIZE, 1, file) != 1)
if(fread(ram, PRU0_DRAM_SIZE, 1, file) != 1)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Watch out for whitespace changes. Esp when it's stuffing the indent up :-)

@@ -51,14 +51,25 @@ AP_RangeFinder_BBB_PRU::AP_RangeFinder_BBB_PRU(RangeFinder::RangeFinder_State &_
bool AP_RangeFinder_BBB_PRU::detect()
{
bool result = true;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Won't need result any more.

rangerpru = (volatile struct range*)ram;

return result;
return result;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can return true here... also, whitespace :-)

Copy link
Copy Markdown
Contributor

@peterbarker peterbarker left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Factoring out a load_file_at_address(...) could be nice here, and cut down on the failure cases you need to worry about.

goto FAIL_MEM_FD;
}

uint32_t *ctrl = (uint32_t*)mmap(0, 0x1000, PROT_READ | PROT_WRITE, MAP_SHARED, mem_fd, PRU0_CTRL_BASE);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This must be unmapped in the relevant failure cases.

uint32_t *ctrl;
void *ram;
uint32_t mem_fd = open("/dev/mem", O_RDWR | O_SYNC | O_CLOEXEC);
if(mem_fd == -1) {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

spaces after ifs

@@ -83,14 +87,12 @@ bool AP_RangeFinder_BBB_PRU::detect()

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

return value of this mmap isn't checked

{
result = false;
if(file == nullptr) {
goto FAIL_FOPEN;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You will need a separate label for this. FAIL_FOPEN_DATA, perhaps?

@OXINARF OXINARF added the Library label Jul 4, 2018
@OXINARF OXINARF requested a review from mirkix July 4, 2018 12:26
@khancyr
Copy link
Copy Markdown
Contributor

khancyr commented Jul 14, 2021

This is bitrooting and low on safety as it touch only the PRU code. I will close this. Feel free to reopen with the requested changes. thanks anyway

@khancyr khancyr closed this Jul 14, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants