linux-kernel - [PATCH] libnvdimm: Fix dereference of pointer ndns before it is null checked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20200915070609.123591-1-jingxiangfeng@huawei.com>
Date:   Tue, 15 Sep 2020 15:06:09 +0800
From:   Jing Xiangfeng <jingxiangfeng@...wei.com>
To:     <dan.j.williams@...el.com>, <vishal.l.verma@...el.com>,
        <dave.jiang@...el.com>, <ira.weiny@...el.com>
CC:     <linux-nvdimm@...ts.01.org>, <linux-kernel@...r.kernel.org>,
        <jingxiangfeng@...wei.com>
Subject: [PATCH] libnvdimm: Fix dereference of pointer ndns before it is null checked

In current code, the pointer ndns is being dereferenced on the
initialization of pointer parent_uuid before ndns is null check. This
could lead to a potential null pointer dereference. Fix this by
dereferencing ndns after ndns has been null pointer sanity checked.

Signed-off-by: Jing Xiangfeng <jingxiangfeng@...wei.com>
---
 drivers/nvdimm/pfn_devs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index 3e11ef8d3f5b..c443994f81f3 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -452,7 +452,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
 	unsigned long align, start_pad;
 	struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb;
 	struct nd_namespace_common *ndns = nd_pfn->ndns;
-	const u8 *parent_uuid = nd_dev_to_uuid(&ndns->dev);
+	const u8 *parent_uuid;
 
 	if (!pfn_sb || !ndns)
 		return -ENODEV;
@@ -472,6 +472,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
 		return -ENODEV;
 	pfn_sb->checksum = cpu_to_le64(checksum);
 
+	parent_uuid = nd_dev_to_uuid(&ndns->dev);
 	if (memcmp(pfn_sb->parent_uuid, parent_uuid, 16) != 0)
 		return -ENODEV;
 
-- 
2.17.1