linux-kernel - Re: [PATCH v2] mtd: phram: error handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151110182047.GP12143@google.com>
Date:	Tue, 10 Nov 2015 10:20:47 -0800
From:	Brian Norris <computersforpeace@...il.com>
To:	Saurabh Sengar <saurabh.truth@...il.com>
Cc:	andy.shevchenko@...il.com, joern@...ybastard.org,
	dwmw2@...radead.org, linux-mtd@...ts.infradead.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] mtd: phram: error handling

On Mon, Nov 09, 2015 at 11:53:18AM +0530, Saurabh Sengar wrote:
> registering the device with NULL pointer can lead to crash,
> hence fixing it
> 
> Signed-off-by: Saurabh Sengar <saurabh.truth@...il.com>
> ---
> > Andy Shevchenko wrote:
> > Hmm… Why not just checking it before an register attempt? I think user
> > is in right to know as many problems as they have at one shot, with
> > your patch if there are two problems the user has to try twice.
> Yes, taken your feedback, fixing it here in v2 as you recommended
> 
>  drivers/mtd/devices/phram.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
> index 8b66e52..46b7a8a 100644
> --- a/drivers/mtd/devices/phram.c
> +++ b/drivers/mtd/devices/phram.c
> @@ -257,6 +257,9 @@ static int phram_setup(const char *val)
>  		parse_err("illegal device length\n");
>  	}
>  
> +	if(!name)
> +		return -EINVAL;

I'm not sure how this is supposed to do anything... just because you
kfree()'d the name doesn't mean it is NULL. In fact, I don't see how
you'd get name==NULL at all. It is assigned once (in parse_name()), and
if it's NULL, we already exit early. And 'name' is never modified after
that point.

So... did you test your patch?

(*looks at the existing code a bit more*)

Hey, I think your patch is all futile anyway. Did you notice that
there's a "return" statement embedded in the parse_err() macro? So there
was no bug in the first place, and I think you're just blowing smoke.

Please verify that you're actually fixing bugs, and please test your
patches. Otherwise, you're wasting my time.

Brian

> +
>  	ret = register_device(name, start, len);
>  	if (!ret)
>  		pr_info("%s device: %#llx at %#llx\n", name, len, start);
> -- 
> 1.9.1
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/