linux-kernel - Re: [PATCH 1 of 1]: musb: fixed a potential NULL pointer dereference.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140212162009.GA23327@kroah.com>
Date:	Wed, 12 Feb 2014 08:20:09 -0800
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	"Dr. H. Nikolaus Schaller" <hns@...delico.com>
Cc:	Felipe Balbi <balbi@...com>, linux-usb@...r.kernel.org,
	LKML <linux-kernel@...r.kernel.org>,
	Marek Belisko <marek@...delico.com>
Subject: Re: [PATCH 1 of 1]: musb: fixed a potential NULL pointer dereference.

On Wed, Feb 12, 2014 at 04:35:12PM +0100, Dr. H. Nikolaus Schaller wrote:
> 
> Am 12.02.2014 um 15:29 schrieb Greg Kroah-Hartman:
> 
> > On Wed, Feb 12, 2014 at 11:08:22AM +0100, Dr. H. Nikolaus Schaller wrote:
> >> fixed a potential NULL pointer dereference.
> >> 
> >>    Rationale:
> >>    this is the only location in the musb driver where the
> >>    otg->gadget pointer is dereferenced. Assuming that it
> >>    is never NULL is not only potentially unsafe but was
> >>    observed in the wild on a GTA04 (OMAP3/TPS65950 based
> >>    board) when trying to boot a device tree based 3.14-rc2
> >>    kernel with USB cable plugged in.
> >> 
> >>    DT boot appears to modify the order in which components
> >>    (gadget driver) are loaded and linked and therefore
> >>    an early musb interrupt triggers with a NULL gadget
> >>    pointer ending in a kernel panic.
> >> 
> >>    Since a non-existing gadget can never be "active" we
> >>    simply use a 0 value for musb->is_active.
> >> 
> >>    Signed-off-by: H. Nikolaus Schaller <hns@...delico.com>
> > 
> > Please don't attach patches, our tools don't like them at all.
> 
> Sorry. That was by accident. Here is the patch appended.

That's better, but we need a "clean" patch to be able to apply it for
real :)

> > And shouldn't we fix the root problem here, not just gloss over the fact
> > that this pointer is NULL at this point in time?  Fixing the real issue
> > should be the correct solution, right?
> 
> Well,
> I must admit that I have no idea what the root cause could be 
> (because I neither know the musb nor the gadget subsystems)
> or if it is intended and just something in the initialization
> sequence has changed.
> 
> I have done one more test and it appears to be in a non-device-tree
> 3.14-rc1 as well. We did not see it in a 3.12.7 kernel on the same hardware.

Ah, can you run 'git bisect' to track down the real problem here?  We
don't like papering over problems like this, that doesn't help anyone
out.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/