linux-kernel - Re: [PATCH 6/6] drivers/net/pppol2tp.c: remove null pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 12 May 2008 21:00:24 +0200 (CEST)
From:	Julia Lawall <julia@...u.dk>
To:	James Chapman <jchapman@...alix.com>
Cc:	linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org,
	netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH 6/6] drivers/net/pppol2tp.c: remove null pointer dereference

On Mon, 12 May 2008, James Chapman wrote:

> Adding netdev to CC list.
> 
> Julia Lawall wrote:
> > From: Julia Lawall <julia@...u.dk>
> > 
> > If session is NULL, it is not possible to access its name field.  So I have
> > split apart the printing of the error message to drop the printing of the
> > name field in this case.
> 
> I suggest add a note in the patch description that this bug will only be hit
> if the driver's debug is enabled.

I don't understand the above comment.  In both the original and the new 
code, if session is NULL, the first argument to PRINTK is -1 and the 
second argument is PPPOL2TP_MSG_CONTROL, for which the only definition 
seems to be the on in include/linux/if_pppol2tp.h, where it has a non-zero 
value.  So the test in the definition of PRINTK is non-zero and the print 
occurs.  Perhaps this is not what is wanted?

julia


> > This problem was found using the following semantic match
> > (http://www.emn.fr/x-info/coccinelle/)
> > 
> > // <smpl>
> > @@
> > expression E, E1;
> > identifier f;
> > statement S1,S2,S3;
> > @@
> > 
> > * if (E == NULL)
> > {
> >   ... when != if (E == NULL) S1 else S2
> >       when != E = E1
> > * E->f
> >   ... when any
> >   return ...;
> > }
> > else S3
> > // </smpl>
> 
> Perhaps the above text should be in the additional info section of the patch
> description?
> 
> Since this is a network driver, can you resubmit the patch to netdev?
> 
> > Signed-off-by: Julia Lawall <julia@...u.dk>
> > 
> > ---
> > 
> > diff -u -p a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
> > --- linux-2.6/drivers/net/pppol2tp.c	2008-05-09 16:46:57.000000000 +0200
> > +++ linuxcopy/drivers/net/pppol2tp.c	2008-05-12 15:30:52.000000000 +0200
> > @@ -1621,9 +1621,16 @@ out_no_ppp:
> >  end:
> >   release_sock(sk);
> > 
> > -	if (error != 0)
> > -		PRINTK(session ? session->debug : -1, PPPOL2TP_MSG_CONTROL,
> > KERN_WARNING,
> > -		       "%s: connect failed: %d\n", session->name, error);
> > +	if (error != 0) {
> > +		if (session)
> > +			PRINTK(session->debug,
> > +				PPPOL2TP_MSG_CONTROL, KERN_WARNING,
> > +				"%s: connect failed: %d\n",
> > +				session->name, error);
> > +		else
> > +			PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_WARNING,
> > +				"connect failed: %d\n", error);
> > +	}
> >  
> >  	return error;
> >  }
> > 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/