linux-kernel - Re: [PATCH][rfc] media, video, stv06xx, pb0100: Don't potentially deref NULL in pb0100

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 14 Jan 2011 10:40:40 +0100
From:	Hans de Goede <hdegoede@...hat.com>
To:	Jesper Juhl <jj@...osbits.net>
CC:	linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
	Jean-Francois Moine <moinejf@...e.fr>,
	Mauro Carvalho Chehab <mchehab@...radead.org>,
	Lee Jones <lee.jones@...onical.com>
Subject: Re: [PATCH][rfc] media, video, stv06xx, pb0100: Don't potentially
 deref NULL in pb0100_start().

Hi,

On 01/13/2011 11:05 PM, Jesper Juhl wrote:
> usb_altnum_to_altsetting() may return NULL. If it does we'll dereference a
> NULL pointer in
> drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c::pb0100_start().
> As far as I can tell there's not really anything more sensible than
> -ENODEV that we can return in that situation, but I'm not at all intimate
> with this code so I'd like a bit of review/comments on this before it's
> applied.
> Anyway, here's a proposed patch.
>

Hi,

On 01/13/2011 11:05 PM, Jesper Juhl wrote:
 > usb_altnum_to_altsetting() may return NULL. If it does we'll dereference a
 > NULL pointer in
 > drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c::pb0100_start().
 > As far as I can tell there's not really anything more sensible than
 > -ENODEV that we can return in that situation, but I'm not at all intimate
 > with this code so I'd like a bit of review/comments on this before it's
 > applied.
 > Anyway, here's a proposed patch.
 >

pb0100_start gets called from stv06xx_start, which also does a
usb_altnum_to_altsetting(intf, sd->gspca_dev.alt); and does contain the
NULL check before calling pb0100_start. So I left out the check on purpose,
to keep the code compact in IMHO better readable.

Still I agree this is a bit tricky. So not NACK but not ACK either. What
do others think?

Regards,

Hans


> Signed-off-by: Jesper Juhl<jj@...osbits.net>
> ---
>   stv06xx_pb0100.c |    2 ++
>   1 file changed, 2 insertions(+)
>
>    compile tested only.
>
> diff --git a/drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c b/drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c
> index ac47b4c..75a5b9c 100644
> --- a/drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c
> +++ b/drivers/media/video/gspca/stv06xx/stv06xx_pb0100.c
> @@ -217,6 +217,8 @@ static int pb0100_start(struct sd *sd)
>
>   	intf = usb_ifnum_to_if(sd->gspca_dev.dev, sd->gspca_dev.iface);
>   	alt = usb_altnum_to_altsetting(intf, sd->gspca_dev.alt);
> +	if (!alt)
> +		return -ENODEV;
>   	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
>
>   	/* If we don't have enough bandwidth use a lower framerate */
>
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/