linux-kernel - Re: [PATCH] platform/x86: wmi: fix potential null pointer dereferences

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 27 Jan 2019 12:46:37 +0100
From:   Mattias Jacobsson <2pi@....nu>
To:     Darren Hart <dvhart@...radead.org>
CC:     <andy@...radead.org>, <platform-driver-x86@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <2pi@....nu>
Subject: Re: [PATCH] platform/x86: wmi: fix potential null pointer
 dereferences

Hi Darren,

On 2019-01-26, Darren Hart wrote:
> On Tue, Jan 22, 2019 at 09:03:01PM +0100, Mattias Jacobsson wrote:
> > In the function wmi_dev_match() there are three variables that
> > potentially can result in a null pointer dereference. Namely:
> 
> Is this something you have observed? This gets called when a new driver
> registered for each unassociated device on the bus, so I'm not
> immediately seeing how dev or driver would end up being NULL here.

I've observed that wmi_driver->id_table can be NULL, that can happen
when a WMI driver registers itself without specifying an id_table.

When adding a NULL check for wmi_driver->id_table, it felt wrong to not
do the same check for driver. After all, driver is a pointer given to me
from someone else, and can therefore be NULL. The same reasoning applies
to dev.

> 
> See: Documentation/driver-model/bus.txt
> 
> -- 
> Darren Hart
> VMware Open Source Technology Center

Thanks,
Mattias