linux-kernel - Re: hwmon: (sis5595) potential null pointer dereference in probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <4831596552157@mail.yandex.ru>
Date:   Tue, 04 Aug 2020 17:48:48 +0300
From:   Evgeny Novikov <novikov@...ras.ru>
To:     Guenter Roeck <linux@...ck-us.net>,
        Jean Delvare <jdelvare@...e.com>
Cc:     "linux-hwmon@...r.kernel.org" <linux-hwmon@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        ldv-project-org <ldv-project@...uxtesting.org>
Subject: Re: hwmon: (sis5595) potential null pointer dereference in probe

04.08.2020, 17:33, "Guenter Roeck" <linux@...ck-us.net>:
> On 8/4/20 4:50 AM, Evgeny Novikov wrote:
>>  sis5595_pci_probe() registers platform driver callbacks and just then
>>  initializes global pointer variable s_bridge. sis5595_probe() may
>>  dereference it before this happens that can result in null pointer
>>  dereference.
>
> sis5595_probe() is only called after the device is registered,
> which happens in sis5595_device_add() after s_bridge is set. This is
> a southbridge, so there won't be any hot insertion/removal events.
>

Thank you for this hint. We need to tune our models appropriately.

>>  We can not swap registration of platform driver callbacks with
>>  initialization of s_bridge since sm_sis5595_exit() assumes the
>>  current order. Perhaps it has sense to implement a pci_driver.remove
>>  callback that will take care about deregistration of platform driver
>>  callbacks.
>
> Agreed regarding the remove function. However, given the age of the chip,
> I'd rather remove the driver than spending time on cleanup efforts.
> This looks like a perfect candidate for depreciation.
>

This is completely up to you. Anyway the driver does not have the bug.

Best regards,
Evgeny

> Guenter