linux-kernel - Re: [PATCH] HID: hidraw, fix a NULL pointer dereference in hidraw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20101005222917.9f4da7bc.ospite@studenti.unina.it>
Date:	Tue, 5 Oct 2010 22:29:17 +0200
From:	Antonio Ospite <ospite@...denti.unina.it>
To:	Alan Ott <alan@...nal11.us>
Cc:	linux-input@...r.kernel.org, Jiri Kosina <jkosina@...e.cz>,
	Oliver Neukum <oliver@...kum.name>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] HID: hidraw, fix a NULL pointer dereference in
 hidraw_ioctl

On Mon, 04 Oct 2010 09:54:21 -0400
Alan Ott <alan@...nal11.us> wrote:

> On 10/02/2010 07:25 AM, Antonio Ospite wrote:
> > BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
> > IP: [<ffffffffa02c66b4>] hidraw_ioctl+0xfc/0x32c [hid]
> > [...]
> >
[...]
> > there is a similar problem when _writing_ to the device, but Alan's
> > changes in that area are shuffling the code a bit, should I send a patch
> > [to hidraw_send_report()] on top of Alan's work for that, or a fix for
> > current mainline [in hidraw_write()] on which Alan should rebase his
> > work would be better?
> >    
> 
> This needs to go back into stable kernels as well, so a patch against 
> mainline will be necessary for that. If you want to make a patch against 
> mine, that's fine with me. If you want me to work it into my patch, 
> that's fine too. (I want you to get credit for the fix though :) ).
>

Alan rebasing your patch on top of the hidraw_write() fix is trivial
so you do it in your v5, ok? It does not get rebased automatically just
because of the mutex_lock() call.

If it is OK to you I'd promote my Tested-by to a Signed-off-by in
the commit message so to take implicit credit for the fix. But this is
not even needed as the fix will be in mainline anyway.

> > The same pattern of unchecked hidraw_table[minor] is also present in
> > hidraw_get_report but this function is called only after the NULL check
> > in hidraw_ioctl _for_now_, so that is currently safe.
> >    
> 
> I can stick a comment ahead of hidraw_send_report, similar to the one 
> which already exists.
>

ACK.

Thanks,
   Antonio

-- 
Antonio Ospite
http://ao2.it

PGP public key ID: 0x4553B001

A: Because it messes up the order in which people normally read text.
   See http://en.wikipedia.org/wiki/Posting_style
Q: Why is top-posting such a bad thing?

Content of type "application/pgp-signature" skipped