linux-kernel - Re: [dm-devel] [PATCH 2/6] drivers/md: remove null pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080702105434.GF22522@agk.fab.redhat.com>
Date:	Wed, 2 Jul 2008 11:54:34 +0100
From:	Alasdair G Kergon <agk@...hat.com>
To:	device-mapper development <dm-devel@...hat.com>
Cc:	linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: Re: [dm-devel] [PATCH 2/6] drivers/md: remove null pointer dereference

On Mon, May 12, 2008 at 03:37:31PM +0200, Julia Lawall wrote:
> If pgpath->pg->ps.type is NULL, it is not possible to access its name
> field.  So I have simply modified the error message to drop the printing of
> the name field.
> 
> This problem was found using the following semantic match
> (http://www.emn.fr/x-info/coccinelle/)
 
> --- a/drivers/md/dm-mpath.c	2008-04-16 13:27:57.000000000 +0200
> +++ b/drivers/md/dm-mpath.c	2008-05-12 09:19:35.000000000 +0200
> @@ -884,8 +884,7 @@ static int reinstate_path(struct pgpath 
>  		goto out;
>  
>  	if (!pgpath->pg->ps.type) {
> -		DMWARN("Reinstate path not supported by path selector %s",
> -		       pgpath->pg->ps.type->name);
> +		DMWARN("Reinstate path not supported by path selector");
>  		r = -EINVAL;
>  		goto out;
>  	}
 
Thanks for reporting this.

A more-sophisticated checker might discover that the test can never fail
- see parse_path_selector() - and so the real problem here is that it is
the wrong test.

The next line is:
	r = pgpath->pg->ps.type->reinstate_path(&pgpath->pg->ps, &pgpath->path);
and the error message makes it clear that the intent was to ensure that
the reinstate_path method exists before attempting to use it.

IOW
	if (!pgpath->pg->ps.type->reinstate_path) {

Alasdair
-- 
agk@...hat.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/