linux-kernel - Re: tty: serial: fsl_lpuart: fix DMA mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <abbbbe20-95d5-e1b1-0538-68a4c7d0c8d6@canonical.com>
Date:   Fri, 3 Apr 2020 14:13:05 +0100
From:   Colin Ian King <colin.king@...onical.com>
To:     Michael Walle <michael@...le.cc>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jiri Slaby <jslaby@...e.com>, linux-serial@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: tty: serial: fsl_lpuart: fix DMA mapping - static analysis bug
 report

On 03/04/2020 14:05, Michael Walle wrote:
> Am 2020-04-03 14:44, schrieb Colin Ian King:
>> Hi,
>>
>> Static analysis with Coverity has found an issue with the following
>> commit:
>>
>> From a092ab25fdaa445b821f5959e458350696fce44c Mon Sep 17 00:00:00 2001
>> From: Michael Walle <michael@...le.cc>
>> Date: Fri, 6 Mar 2020 22:44:31 +0100
>> Subject: [PATCH] tty: serial: fsl_lpuart: fix DMA mapping
>>
>> The analysis report is as follows for function lpuart_dma_rx_free in
>> source drivers/tty/serial/fsl_lpuart.c :
>>
>> var_compare_op: Comparing chan to null implies that chan might be null.
>>
>> 1234        if (chan)
>> 1235                dmaengine_terminate_all(chan);
>> 1236
>>
>> Dereference after null check (FORWARD_NULL)
>> var_deref_op: Dereferencing null pointer chan.
>>
>> 1237        dma_unmap_sg(chan->device->dev, &sport->rx_sgl, 1,
>> DMA_FROM_DEVICE);
>>
>> The check for chan being null implies it is may be null, however, the
>> call to dma_unmap_sg dereferences chan which leads to a null pointer
>> dereference issue.
> 
> Technically, this is correct. But lpuart_dma_rx_free() is guarded by
> lpuart_dma_rx_use which is only true if there is a dma channel, see
> lpuart_rx_dma_startup(). In any way, this looks bogus.
> 
> So actually, the "if (chan)" is superfluous. Could you double check that?
> Then I'd make a patch which removes the if (chan) to make coverity happy.

Yep, I've eyeballed the code and all the calls to the
lpuart_dma_rx_free() check lpuart_dma_rx_use is true before the call, so
it does appear the if (chan) check is superfluous.

Colin
> 
> -michael