linux-kernel - Re: [PATCH] Gpu: drm: arm: - Fix possible dereference of NULL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 11 Nov 2016 14:29:52 +0000
From:   Liviu Dudau <liviu.dudau@....com>
To:     Emil Velikov <emil.l.velikov@...il.com>
Cc:     Shailendra Verma <shailendra.v@...sung.com>,
        vidushi.koul@...sung.com,
        "Linux-Kernel@...r. Kernel. Org" <linux-kernel@...r.kernel.org>,
        ML dri-devel <dri-devel@...ts.freedesktop.org>,
        Mali DP Maintainers <malidp@...s.arm.com>,
        Shailendra Verma <shailendra.capricorn@...il.com>
Subject: Re: [PATCH] Gpu: drm: arm: - Fix possible dereference of NULL

On Fri, Nov 11, 2016 at 01:58:46PM +0000, Emil Velikov wrote:
> On 11 November 2016 at 10:56, Liviu Dudau <liviu.dudau@....com> wrote:
> > Hi Shailendra,
> >
> > On Fri, Nov 11, 2016 at 02:16:08PM +0530, Shailendra Verma wrote:
> >> From: "Shailendra Verma" <shailendra.v@...sung.com>
> >>
> >> There is possible dereference of NULL pointer if kmalloc fails.
> >
> > You could add: ... when the function returns. From the patch itself it is
> > not clear where the problem is.
> >
> As the function returns we have "return &state->base;" Since base is
> at offset 0 there will be no deref and the compiler will return NULL.
> Not sure if that's 100% legal, though.
> 
> >> ---
> >>  drivers/gpu/drm/arm/malidp_planes.c |    3 +++
> >>  1 file changed, 3 insertions(+)
> >>
> >> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
> >> index 82c193e..f769398 100644
> >> --- a/drivers/gpu/drm/arm/malidp_planes.c
> >> +++ b/drivers/gpu/drm/arm/malidp_planes.c
> >> @@ -54,6 +54,9 @@ struct drm_plane_state *malidp_duplicate_plane_state(struct drm_plane *plane)
> >>               return NULL;
> >>
> >>       state = kmalloc(sizeof(*state), GFP_KERNEL);
> >> +     if (!state)
> >> +             return NULL;
> >> +
> >>       if (state) {
> Might want to drop this line - as-is things read quite weird ?

I've already done that in the patched that I've queued in my tree, I just need to push
it to the public tree.

... now if that server would be online when I need it .... :(

Best regards,
Liviu

> 
> Either way, not my driver - so don't read too much into the above ;-)
> Emil

-- 
====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯