file removal issue in tools/testing/selftests/powerpc/mm/tlbie_test.c

From: Colin King (gmail) <hidden>
Date: 2023-06-15 16:02:27
Also in: linux-kselftest, lkml

Hi,

Static analysis with cppcheck has found an issue in the following commit:

commit 047e6575aec71d75b765c22111820c4776cd1c43
Author: Aneesh Kumar K.V [off-list ref]
Date:   Tue Sep 24 09:22:53 2019 +0530

     powerpc/mm: Fixup tlbie vs mtpidr/mtlpidr ordering issue on POWER9


The issue in tools/testing/selftests/powerpc/mm/tlbie_test.c in 
end_verification_log() is as follows:

static inline void end_verification_log(unsigned int tid, unsigned 
nr_anamolies)
{
         FILE *f = fp[tid];
         char logfile[30];
         char path[LOGDIR_NAME_SIZE + 30];
         char separator[] = "/";

         fclose(f);

         if (nr_anamolies == 0) {
                 remove(path);
                 return;
         }
	.... etc


in the case where nr_anamolies is zero the remove(path) call is using an 
uninitialized path, this potentially could contain uninitialized garbage 
on the stack (and if one is unlucky enough it may be a valid filename 
that one does not want to be removed).

Not sure what the original intention was, but this code looks incorrect 
to me.

Colin
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help