linux-kernel - Re: [PATCH 1/2] staging: dgap: fix possible NULL dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 11 Sep 2015 19:54:04 -0700
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	Sudip Mukherjee <sudipm.mukherjee@...il.com>
Cc:	Lidza Louina <lidza.louina@...il.com>,
	Mark Hounschell <markh@...pro.net>,
	Daeseok Youn <daeseok.youn@...il.com>,
	devel@...verdev.osuosl.org, driverdev-devel@...uxdriverproject.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] staging: dgap: fix possible NULL dereference

On Thu, Sep 10, 2015 at 05:24:58PM +0530, Sudip Mukherjee wrote:
> The return pointer from dgap_getword() is used in strcmp() where it is
> dereferenced. But dgap_getword() can return NULL.
> Lets put a check there and return 0 as error.
> 
> Signed-off-by: Sudip Mukherjee <sudip@...torindia.org>
> ---
>  drivers/staging/dgap/dgap.c | 2 ++
>  1 file changed, 2 insertions(+)

While this change is all nice and fine, this driver is totally abusing
the firmware kernel interface to read in a "configuration file" and then
parse it within the driver.  That's not ok at all, no tty driver should
ever need this.  Please work to just rip all of that crap out.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/