linux-kernel - Re: [PATCH] rpmsg: rpmsg_core: fix null-ptr dereference for devices without ops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <46048bd4-482d-37e8-9701-71754f72ffc2@ti.com>
Date:   Fri, 2 Jun 2017 16:47:51 -0500
From:   Suman Anna <s-anna@...com>
To:     Henri Roosen <henri.roosen@...zinger.com>,
        <linux-remoteproc@...r.kernel.org>
CC:     Ohad Ben-Cohen <ohad@...ery.com>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] rpmsg: rpmsg_core: fix null-ptr dereference for devices
 without ops

Hi Henri,

On 06/02/2017 06:35 AM, Henri Roosen wrote:
> A device might not have an ops structure registered. This

The rpmsg devices are registered from the respective backends, which are
supposed to plug in their ops. What is the scenario where you think
these ops might not be populated? We ought to check for NULL ops in
rpmsg_register_device in fact to make sure an ops pointer is supplied.

regards
Suman

> patch fixes a null-prt dereference by checking ops before dereferencing
> it.
> 
> Signed-off-by: Henri Roosen <henri.roosen@...zinger.com>
> ---
>  drivers/rpmsg/rpmsg_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
> index 600f5f9..0c48452 100644
> --- a/drivers/rpmsg/rpmsg_core.c
> +++ b/drivers/rpmsg/rpmsg_core.c
> @@ -429,7 +429,7 @@ static int rpmsg_dev_probe(struct device *dev)
>  		goto out;
>  	}
>  
> -	if (rpdev->ops->announce_create)
> +	if (rpdev->ops && rpdev->ops->announce_create)
>  		err = rpdev->ops->announce_create(rpdev);
>  out:
>  	return err;
>