linux-kernel - Re: [PATCH] misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YJrFib6BD8JcX3DM@kroah.com>
Date:   Tue, 11 May 2021 19:57:29 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Tong Zhang <ztong0001@...il.com>
Cc:     Arnd Bergmann <arnd@...db.de>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] misc: alcor_pci: fix null-ptr-deref when there is no PCI
 bridge

On Tue, May 11, 2021 at 10:17:12AM -0700, Tong Zhang wrote:
> On Tue, May 11, 2021 at 12:03 AM Greg Kroah-Hartman
> <gregkh@...uxfoundation.org> wrote:
> >
> > On Mon, May 10, 2021 at 03:20:02PM -0700, Tong Zhang wrote:
> > > On Mon, May 10, 2021 at 7:36 AM Greg Kroah-Hartman
> > > <gregkh@...uxfoundation.org> wrote:
> > > >
> > > > On Mon, Apr 26, 2021 at 06:07:27PM -0400, Tong Zhang wrote:
> > > > > the PCI bridge might be NULL, so we'd better check before use it
> > > >
> > > > I do not understand, how can pci ever be NULL?  There is only 1 way this
> > >
> > > Hi Greg,
> > > I think the problem is with
> > >     priv->parent_pdev = pdev->bus->self
> > > where bus->self can be NULL. when bus->self is NULL, calling
> >
> > How can bus->self be NULL?
> 
> Hi Greg,
> Please correct me if I am wrong,
> when bus->self is not NULL, it means there is a bridge,
> However, a device can be directly attached to the port on the root
> complex. In this case, the bus->self is NULL.

Does that ever happen with a device on the root like that?

> > Did you see this on a real system?  How did you duplicate the error
> > listed here?
> I did this in QEMU. If QEMU is considered not real, then I haven't
> seen an alcor controller configured in this way in a real system.
> That being said, this kind of configuration is still legit IMHO.

Ah, ok, that makes more sense, this is a virtual system.

I suggest, again, steping back up and just not calling this function if
you are on the root, as it does not make any sense to do so for a device
that is not there.

thanks,

greg k-h