linux-kernel - Re: [REGRESSION] brcmfmac: NULL pointer deference starting next-20181107

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d3783759-9030-76bc-d218-6f92b462de7f@nvidia.com>
Date:   Tue, 13 Nov 2018 11:29:19 +0000
From:   Jon Hunter <jonathanh@...dia.com>
To:     Arend van Spriel <arend.vanspriel@...adcom.com>,
        Hans de Goede <hdegoede@...hat.com>,
        Kalle Valo <kvalo@...eaurora.org>,
        linux-tegra <linux-tegra@...r.kernel.org>,
        <linux-wireless@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>
Subject: Re: [REGRESSION] brcmfmac: NULL pointer deference starting
 next-20181107

Hi Arend,

On 13/11/2018 10:24, Arend van Spriel wrote:

...

> I tried building drivers/firmware/efi/vars.c using tegra_defconfig. Had
> to enable CONFIG_EFI. So the null pointer access is a 0x00000008 so I
> looked at the disassembly below:
> 
> int efivar_entry_size(struct efivar_entry *entry, unsigned long *size)
> {
>      310:       e1a05001        mov     r5, r1
>         const struct efivar_operations *ops = __efivars->ops;
> ==>  314:       e5936008        ldr     r6, [r3, #8]
> 
> So I think __efivars is NULL on your platform. It is private to the
> source file. Not sure how the driver should deal with this. Maybe use
> efi_enabled() but not sure what feature to use. My best bet would be
> EFI_RUNTIME_SERVICES.
> 
>         efi_status_t status;
> 
>         *size = 0;
>      318:       e3a03000        mov     r3, #0
>      31c:       e5813000        str     r3, [r1]
> 
>         if (down_interruptible(&efivars_lock))
>      320:       ebfffffe        bl      0 <down_interruptible>
>      324:       e2504000        subs    r4, r0, #0
>      328:       1a000012        bne     378 <efivar_entry_size+0x80>
>                 return -EINTR;
>         status = ops->get_variable(entry->var.VariableName,

So actually, I am seeing the crash with the 'multi_v7_defconfig' and I
don't see it with the 'tegra_defconfig' (probably because CONFIG_EFI is
not enabled).

Cheers
Jon

-- 
nvpublic