linux-kernel - RE: [PATCH] megaraid:Fix possible NULL pointer deference in mraid_mm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <a15502eb3124eb63ab54a50031e587d8@mail.gmail.com>
Date:	Fri, 8 Jan 2016 16:35:33 +0530
From:	Sumit Saxena <sumit.saxena@...gotech.com>
To:	Nicholas Krause <xerofoify@...il.com>,
	Kashyap Desai <kashyap.desai@...gotech.com>
Cc:	Uday Lingala <uday.lingala@...gotech.com>, JBottomley@...n.com,
	martin.petersen@...cle.com,
	"PDL,MEGARAIDLINUX" <megaraidlinux.pdl@...gotech.com>,
	linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: RE: [PATCH] megaraid:Fix possible NULL pointer deference in mraid_mm_ioctl

> -----Original Message-----
> From: Nicholas Krause [mailto:xerofoify@...il.com]
> Sent: Wednesday, January 06, 2016 1:03 AM
> To: kashyap.desai@...gotech.com
> Cc: sumit.saxena@...gotech.com; uday.lingala@...gotech.com;
> JBottomley@...n.com; martin.petersen@...cle.com;
> megaraidlinux.pdl@...gotech.com; linux-scsi@...r.kernel.org; linux-
> kernel@...r.kernel.org
> Subject: [PATCH] megaraid:Fix possible NULL pointer deference in
> mraid_mm_ioctl
>
> This adds the needed check after the call to the function
mraid_mm_alloc_kioc
> in order to make sure that this function has not returned NULL and
therefore
> makes sure we do not deference a NULL pointer if one is returned by
> mraid_mm_alloc_kioc.
> Further more add needed comments explaining that this function call can
return
> NULL if the list head is empty for the pointer passed in order to allow
furture
> users to understand this required pointer check.
>
> Signed-off-by: Nicholas Krause <xerofoify@...il.com>
> ---
>  drivers/scsi/megaraid/megaraid_mm.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/scsi/megaraid/megaraid_mm.c
> b/drivers/scsi/megaraid/megaraid_mm.c
> index a706927..215ddbc 100644
> --- a/drivers/scsi/megaraid/megaraid_mm.c
> +++ b/drivers/scsi/megaraid/megaraid_mm.c
> @@ -179,8 +179,12 @@ mraid_mm_ioctl(struct file *filep, unsigned int
cmd,
> unsigned long arg)
>
>  	/*
>  	 * The following call will block till a kioc is available
> +	 * or return NULL if the list head is empty for the pointer
> +	 * of type mraid_mmapt passed to mraid_mm_alloc_kioc
>  	 */
>  	kioc = mraid_mm_alloc_kioc(adp);
> +	if (!kioc)
> +		return -ENXIO;
>
>  	/*
>  	 * User sent the old mimd_t ioctl packet. Convert it to uioc_t.

Acked-by: Sumit Saxena <sumit.saxena@...gotech.com>

> --
> 2.5.0