linux-kernel - Re: [PATCH] pinctrl: renesas:fix possible null pointer dereference struct pinmux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 9 Feb 2021 15:12:03 +0100
From:   Geert Uytterhoeven <geert@...ux-m68k.org>
To:     alex_luca@....com
Cc:     Linus Walleij <linus.walleij@...aro.org>,
        Linux-Renesas <linux-renesas-soc@...r.kernel.org>,
        "open list:GPIO SUBSYSTEM" <linux-gpio@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Zhang Kun <zhangkun@...rlc.com>
Subject: Re: [PATCH] pinctrl: renesas:fix possible null pointer dereference
 struct pinmux_range *

Hi Alex,

Thanks for your patch!

On Sun, Feb 7, 2021 at 4:08 PM <alex_luca@....com> wrote:
> From: Zhang Kun <zhangkun@...rlc.com>
>
> The parameters of  sh_pfc_enum_in_range() pinmux_range *r should be checked
> first for possible null ponter, especially when PINMUX_TYPE_FUNCTION as the
> pinmux_type was passed by sh_pfc_config_mux().

If pinmux_type in sh_pfc_config_mux() is PINMUX_TYPE_FUNCTION or
PINMUX_TYPE_GPIO, range is indeed NULL.
But as the call

    in_range = sh_pfc_enum_in_range(enum_id, range);

is not done in case of these pinmux types, I don't see where the
problem is.  What am I missing?

> Signed-off-by: Zhang Kun <zhangkun@...rlc.com>

As you picked up a patch from Zhang, you should add your own SoB here.

> --- a/drivers/pinctrl/renesas/core.c
> +++ b/drivers/pinctrl/renesas/core.c
> @@ -128,6 +128,9 @@ int sh_pfc_get_pin_index(struct sh_pfc *pfc, unsigned int pin)
>
>  static int sh_pfc_enum_in_range(u16 enum_id, const struct pinmux_range *r)
>  {
> +       if (!r)
> +               return 0;
> +
>         if (enum_id < r->begin)
>                 return 0;

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds