linux-kernel - Re: [PATCH] platform/x86: wmi: fix potential null pointer dereferences

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190128143845.2gneic5ip5b56mwv@mok.nu>
Date:   Mon, 28 Jan 2019 15:38:45 +0100
From:   Mattias Jacobsson <2pi@....nu>
To:     Andy Shevchenko <andy.shevchenko@...il.com>
CC:     Darren Hart <dvhart@...radead.org>,
        Andy Shevchenko <andy@...radead.org>,
        Platform Driver <platform-driver-x86@...r.kernel.org>,
        "Linux Kernel Mailing List" <linux-kernel@...r.kernel.org>,
        <2pi@....nu>
Subject: Re: [PATCH] platform/x86: wmi: fix potential null pointer
 dereferences

Hi,

On 2019-01-27, Andy Shevchenko wrote:
> On Tue, Jan 22, 2019 at 10:04 PM Mattias Jacobsson <2pi@....nu> wrote:
> >
> > In the function wmi_dev_match() there are three variables that
> > potentially can result in a null pointer dereference. Namely:
> > dev/wblock, driver/wmi_driver, and wmi_driver->id_table.
> >
> > Check for NULL and return that the driver can't handle the device if any
> > of these variables would result in a null pointer dereference.
> >
> > The NULL checks are performed prior to running container_of() for the
> > variables dev/wblock and driver/wmi_driver.
> >
> > Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
> > Signed-off-by: Mattias Jacobsson <2pi@....nu>
> > ---
> >  drivers/platform/x86/wmi.c | 16 ++++++++++++----
> >  1 file changed, 12 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
> > index bea35be68706..c596479e8b13 100644
> > --- a/drivers/platform/x86/wmi.c
> > +++ b/drivers/platform/x86/wmi.c
> > @@ -763,10 +763,18 @@ static void wmi_dev_release(struct device *dev)
> >
> >  static int wmi_dev_match(struct device *dev, struct device_driver *driver)
> >  {
> > -       struct wmi_driver *wmi_driver =
> > -               container_of(driver, struct wmi_driver, driver);
> 
> AFAIU this is just a pointer arithmetics, no need to move it.

That is my understanding too, it seamed backwards to do the NULL check
afterwards, but we still have access to dev and driver. So why not...

> 
> > -       struct wmi_block *wblock = dev_to_wblock(dev);
> 
> > -       const struct wmi_device_id *id = wmi_driver->id_table;
> > +       const struct wmi_device_id *id;
> > +       struct wmi_block *wblock;
> > +       struct wmi_driver *wmi_driver;
> > +
> 
> > +       if (dev == NULL || driver == NULL)
> > +               return 0;
> 
> On which circumstances this may ever happen?

Nothing in particular. If there is a bug in the caller of this function,
then that is when this will come into play. See my earlier mail to
Darren too.

> 
> > +       wblock = dev_to_wblock(dev);
> > +       wmi_driver = container_of(driver, struct wmi_driver, driver);
> > +
> > +       if (wmi_driver->id_table == NULL)
> > +               return 0;
> > +       id = wmi_driver->id_table;
> >
> >         while (id->guid_string) {
> >                 uuid_le driver_guid;
> > --
> > 2.20.1
> >
> 
> 
> -- 
> With Best Regards,
> Andy Shevchenko

Thanks,
Mattias