linux-kernel - Re: [PATCH] Input: synaptics-rmi4 - validate that the rmi_dev pointer is set before dereferencing it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <04107127-63fb-51c9-03d4-0e8e39d19546@synaptics.com>
Date:   Tue, 29 Oct 2019 18:40:13 +0000
From:   Andrew Duggan <aduggan@...aptics.com>
To:     Dmitry Torokhov <dmitry.torokhov@...il.com>
CC:     "linux-input@...r.kernel.org" <linux-input@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Jiri Kosina <jikos@...nel.org>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        Federico Cerutti <federico@...es-c.it>,
        Christopher Heiny <Cheiny@...aptics.com>
Subject: Re: [PATCH] Input: synaptics-rmi4 - validate that the rmi_dev pointer
 is set before dereferencing it

Hi Dmitry,

On 10/28/19 9:19 PM, Dmitry Torokhov wrote:
> CAUTION: Email originated externally, do not click links or open attachments unless you recognize the sender and know the content is safe.
>
>
> Hi Andrew,
>
> On Wed, Oct 23, 2019 at 01:24:05AM +0000, Andrew Duggan wrote:
>> A bug in hid-rmi was causing rmi_unregister_transport_device() to be
>> called even if the call to rmi_register_transport_device() failed to
>> allocate the rmi device. A patch has been submitted to fix the issue in
>> hid-rmi. This patch will ensure that should a simialr situation
>> occur then the rmi driver will not dereference a NULL pointer.
> This looks like "garbage in, garbage out" problem where we should not be
> calling unregister in the first place. I'd rather not apply this.

That's fine, like I said the actual fix to prevent 
rmi_unregister_transport_device() from being called inappropriately is 
in the hid-rmi driver.

https://lore.kernel.org/linux-input/20191023012344.20998-1-aduggan@synaptics.com/

I was on the fence on whether or not it was better to prevent the NULL 
pointer dereference even at the expense of masking bugs like the one in 
the hid-rmi driver.

Thanks for the feedback,

Andrew


> Thanks.
>
> --
> Dmitry