linux-kernel - Re: [PATCH v3] tty: n_gsm: delete DISC command frame as requester

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 5 Jul 2021 12:51:00 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Zhenguo Zhao <zhenguo6858@...il.com>,
        gregkh@...uxfoundation.org, jirislaby@...nel.org
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] tty: n_gsm: delete DISC command frame as requester

Hi Zhenguo,

url:    https://github.com/0day-ci/linux/commits/Zhenguo-Zhao/tty-n_gsm-delete-DISC-command-frame-as-requester/20210705-102943
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git tty-testing
config: openrisc-randconfig-m031-20210705 (attached as .config)
compiler: or1k-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

smatch warnings:
drivers/tty/n_gsm.c:3023 gsmtty_close() warn: variable dereferenced before check 'dlci' (see line 3021)

vim +/dlci +3023 drivers/tty/n_gsm.c

e1eaea46bb4020 drivers/char/n_gsm.c Alan Cox        2010-03-26  3018  static void gsmtty_close(struct tty_struct *tty, struct file *filp)
e1eaea46bb4020 drivers/char/n_gsm.c Alan Cox        2010-03-26  3019  {
e1eaea46bb4020 drivers/char/n_gsm.c Alan Cox        2010-03-26  3020  	struct gsm_dlci *dlci = tty->driver_data;
f72c4013b314ba drivers/tty/n_gsm.c  Zhenguo Zhao    2021-07-05 @3021  	struct gsm_mux *gsm = dlci->gsm;
                                                                                              ^^^^^^^^^^
Dereferenced

6ab8fba7fcb012 drivers/tty/n_gsm.c  Russ Gorby      2011-06-16  3022  
e1eaea46bb4020 drivers/char/n_gsm.c Alan Cox        2010-03-26 @3023  	if (dlci == NULL)
                                                                            ^^^^^^^^^^^^
Check is too late

e1eaea46bb4020 drivers/char/n_gsm.c Alan Cox        2010-03-26  3024  		return;
4d9b109060f690 drivers/tty/n_gsm.c  Dirkjan Bussink 2013-01-30  3025  	if (dlci->state == DLCI_CLOSED)
4d9b109060f690 drivers/tty/n_gsm.c  Dirkjan Bussink 2013-01-30  3026  		return;
bcd5abe28f40cc drivers/tty/n_gsm.c  Russ Gorby      2011-06-16  3027  	mutex_lock(&dlci->mutex);
bcd5abe28f40cc drivers/tty/n_gsm.c  Russ Gorby      2011-06-16  3028  	gsm_destroy_network(dlci);
bcd5abe28f40cc drivers/tty/n_gsm.c  Russ Gorby      2011-06-16  3029  	mutex_unlock(&dlci->mutex);
e1eaea46bb4020 drivers/char/n_gsm.c Alan Cox        2010-03-26  3030  	if (tty_port_close_start(&dlci->port, tty, filp) == 0)
dfabf7ffa30585 drivers/tty/n_gsm.c  Chao Bi         2013-11-26  3031  		return;
f72c4013b314ba drivers/tty/n_gsm.c  Zhenguo Zhao    2021-07-05  3032  	if (gsm->initiator)
e1eaea46bb4020 drivers/char/n_gsm.c Alan Cox        2010-03-26  3033  		gsm_dlci_begin_close(dlci);
d41861ca19c9e9 drivers/tty/n_gsm.c  Peter Hurley    2016-04-09  3034  	if (tty_port_initialized(&dlci->port) && C_HUPCL(tty))
957dacaee56d18 drivers/tty/n_gsm.c  Johan Hovold    2013-03-07  3035  		tty_port_lower_dtr_rts(&dlci->port);
e1eaea46bb4020 drivers/char/n_gsm.c Alan Cox        2010-03-26  3036  	tty_port_close_end(&dlci->port, tty);
e1eaea46bb4020 drivers/char/n_gsm.c Alan Cox        2010-03-26  3037  	tty_port_tty_set(&dlci->port, NULL);
dfabf7ffa30585 drivers/tty/n_gsm.c  Chao Bi         2013-11-26  3038  	return;
e1eaea46bb4020 drivers/char/n_gsm.c Alan Cox        2010-03-26  3039  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org