linux-kernel - Re: [REGRESSION] brcmfmac: NULL pointer deference starting next-20181107

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <82736fa6-f3cc-f45f-a4b0-dba485531f7d@nvidia.com>
Date:   Tue, 13 Nov 2018 13:32:17 +0000
From:   Jon Hunter <jonathanh@...dia.com>
To:     Hans de Goede <hdegoede@...hat.com>,
        Arend van Spriel <arend.vanspriel@...adcom.com>,
        Kalle Valo <kvalo@...eaurora.org>,
        linux-tegra <linux-tegra@...r.kernel.org>,
        <linux-wireless@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>
Subject: Re: [REGRESSION] brcmfmac: NULL pointer deference starting
 next-20181107


On 13/11/2018 13:21, Jon Hunter wrote:

...

>> IMHO the best fix here would be to modify efivar_entry_size(),
>> adding:
>>
>>     if (!ops)
>>         return -ENOENT;
>>
>> Which makes it return the same error as when we do have efivar
>> support but the requested variable is not found.
> 
> So the above did not work. I see a patch from Arend and I will give this
> a try.

FWIW, this did work ...

diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 9336ffdf6e2c..8181e548f32b 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -829,9 +829,14 @@ struct efivar_entry *efivar_entry_find(efi_char16_t
*name, efi_guid_t guid,
  */
 int efivar_entry_size(struct efivar_entry *entry, unsigned long *size)
 {
-       const struct efivar_operations *ops = __efivars->ops;
+       const struct efivar_operations *ops;
        efi_status_t status;

+       if (!__efivars || !__efivars->ops)
+               return -ENOENT;
+
+       ops = __efivars->ops;
+
        *size = 0;

        if (down_interruptible(&efivars_lock))

I will let you know about Arend's patch as well.

Jon

-- 
nvpublic