linux-kernel - Re: [PATCH 1/3] mmc: sdhci-s3c: fix possible NULL pointer dereference when probed via platform

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <74059494-3610-c24e-7d09-b89106c0a396@kernel.org>
Date:   Wed, 14 Apr 2021 18:49:41 +0200
From:   Sylwester Nawrocki <snawrocki@...nel.org>
To:     Krzysztof Kozlowski <krzysztof.kozlowski@...onical.com>,
        Ben Dooks <ben-linux@...ff.org>,
        Jaehoon Chung <jh80.chung@...sung.com>,
        Adrian Hunter <adrian.hunter@...el.com>,
        Ulf Hansson <ulf.hansson@...aro.org>,
        linux-mmc@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     Marek Szyprowski <m.szyprowski@...sung.com>
Subject: Re: [PATCH 1/3] mmc: sdhci-s3c: fix possible NULL pointer dereference
 when probed via platform

On 14.04.2021 17:25, Krzysztof Kozlowski wrote:
> On 14/04/2021 17:12, Krzysztof Kozlowski wrote:
>> The driver can be matched by legacy platform way or OF-device matching.
>> In the first case, of_match_node() can return NULL, which immediately
>> would be dereferenced to get the match data.
>>
>> Addresses-Coverity: Dereference null return value
>> Fixes: cd1b00eb24b0 ("mmc: sdhci-s3c: Add device tree support")
>> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@...onical.com>

>> -#ifdef CONFIG_OF
>> -static const struct of_device_id sdhci_s3c_dt_match[];
>> -#endif
>> -
>>   static inline struct sdhci_s3c_drv_data *sdhci_s3c_get_driver_data(
>>   			struct platform_device *pdev)
>>   {
>>   #ifdef CONFIG_OF
>> -	if (pdev->dev.of_node) {
>> -		const struct of_device_id *match;
>> -		match = of_match_node(sdhci_s3c_dt_match, pdev->dev.of_node);
> 
> Now I have second thoughts whether NULL pointer can actually happen.  If
> device is matched via platform/board files, maybe the pdev->dev.of_node
> will be NULL thus skipping this branch?
> 
> Could there be a case where device is matched via platform_device_id()
> (which has different name than compatible!) and (pdev->dev.of_node) is
> still assigned? Maybe in case of out of tree DTS?

That seems unlikely, the platform device would need to be initialized
via board file and then its of_node assigned somehow. It doesn't make
much sense to me. We either use board file or dtb to instantiate devices.

> Anyway, the patch makes the code simpler/smaller, so I still think it is
> reasonable. Just the severity of issue is questionable...

Yes, the patch looks good. Similar cleanups are already done in most of
the s3c/s5p/exynos drivers.

--
Thanks,
Sylwester