linux-kernel - Re: [PATCH] Gpu: drm: arm: - Fix possible dereference of NULL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 11 Nov 2016 13:58:46 +0000
From:   Emil Velikov <emil.l.velikov@...il.com>
To:     Liviu Dudau <liviu.dudau@....com>
Cc:     Shailendra Verma <shailendra.v@...sung.com>,
        vidushi.koul@...sung.com,
        "Linux-Kernel@...r. Kernel. Org" <linux-kernel@...r.kernel.org>,
        ML dri-devel <dri-devel@...ts.freedesktop.org>,
        Mali DP Maintainers <malidp@...s.arm.com>,
        Shailendra Verma <shailendra.capricorn@...il.com>
Subject: Re: [PATCH] Gpu: drm: arm: - Fix possible dereference of NULL

On 11 November 2016 at 10:56, Liviu Dudau <liviu.dudau@....com> wrote:
> Hi Shailendra,
>
> On Fri, Nov 11, 2016 at 02:16:08PM +0530, Shailendra Verma wrote:
>> From: "Shailendra Verma" <shailendra.v@...sung.com>
>>
>> There is possible dereference of NULL pointer if kmalloc fails.
>
> You could add: ... when the function returns. From the patch itself it is
> not clear where the problem is.
>
As the function returns we have "return &state->base;" Since base is
at offset 0 there will be no deref and the compiler will return NULL.
Not sure if that's 100% legal, though.

>> ---
>>  drivers/gpu/drm/arm/malidp_planes.c |    3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
>> index 82c193e..f769398 100644
>> --- a/drivers/gpu/drm/arm/malidp_planes.c
>> +++ b/drivers/gpu/drm/arm/malidp_planes.c
>> @@ -54,6 +54,9 @@ struct drm_plane_state *malidp_duplicate_plane_state(struct drm_plane *plane)
>>               return NULL;
>>
>>       state = kmalloc(sizeof(*state), GFP_KERNEL);
>> +     if (!state)
>> +             return NULL;
>> +
>>       if (state) {
Might want to drop this line - as-is things read quite weird ?

Either way, not my driver - so don't read too much into the above ;-)
Emil