linux-kernel - Re: [patch] driver-core: dev_to_node() should handle NULL pointers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120720151846.GQ16348@mwanda>
Date:	Fri, 20 Jul 2012 18:18:46 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:	Grant Likely <grant.likely@...retlab.ca>,
	Rob Herring <rob.herring@...xeda.com>,
	Lars-Peter Clausen <lars@...afoo.de>,
	linux-kernel@...r.kernel.org, devicetree-discuss@...ts.ozlabs.org,
	kernel-janitors@...r.kernel.org
Subject: Re: [patch] driver-core: dev_to_node() should handle NULL pointers

On Fri, Jul 20, 2012 at 08:00:42AM -0700, Greg Kroah-Hartman wrote:
> On Fri, Jul 20, 2012 at 09:56:23AM +0300, Dan Carpenter wrote:
> > What prompted this patch is that in dma_pool_create() we call
> > dev_to_node() before checking whether "dev" is NULL.  It looks like
> > there are places which call dma_pool_create() with a NULL pointer.  An
> > example is in drivers/usb/gadget/amd5536udc.c.
> > 
> > Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> > ---
> > Static checker fix.
> > 
> > diff --git a/include/linux/device.h b/include/linux/device.h
> > index aa7b3b4..c80e7a8d 100644
> > --- a/include/linux/device.h
> > +++ b/include/linux/device.h
> > @@ -714,7 +714,9 @@ int dev_set_name(struct device *dev, const char *name, ...);
> >  #ifdef CONFIG_NUMA
> >  static inline int dev_to_node(struct device *dev)
> >  {
> > -	return dev->numa_node;
> > +	if (dev)
> > +		return dev->numa_node;
> > +	return -1;
> 
> What happens if this function returns -1?  Can the callers properly
> handle this?
> 

Gar.  Now I'm not sure any more.

-1 means no affinity and it's what the dev_to_node() returns if NUMA
is disabled.  But now I think probably it's important to get the
NUMA node correct in dma_pool_create() so this isn't the right
answer.

dma_pool_create() is not correct.  It has code to handle a NULL
"dev" pointer, but the dev_to_node() dereference will cause an oops
before we reach it.  I'm think this is a real issue that affects a
couple drivers.  Maybe those people compile without NUMA?

I'm not sure the right fix now.

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/