linux-kernel - 回复: drivers/char: suspected null-pointer dereference problem in handle_control

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <TYCP286MB11885C2C4C12BFBB42F0D9CE8A849@TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM>
Date:   Tue, 26 Oct 2021 11:51:37 +0000
From:   YE Chengfeng <cyeaa@...nect.ust.hk>
To:     Amit Shah <amit@...radead.org>,
        "amit@...nel.org" <amit@...nel.org>,
        "arnd@...db.de" <arnd@...db.de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: 回复: drivers/char: suspected null-pointer dereference problem in handle_control_message

Thanks for your reply.

Agree with you, seems that the branch at #line 1573 already handles this situation.

Another question, is it possible that port->name is null when show_port_name is invoked? I don't see any null-check there, could it be a null-dereference problem at #line 1282? Link is below.
https://github.com/torvalds/linux/blob/master/drivers/char/virtio_console.c#L1282

Best Regards.
Chengfeng
-----邮件原件-----
发件人: Amit Shah <amit@...radead.org> 
发送时间: 2021年10月26日 18:30
收件人: YE Chengfeng <cyeaa@...nect.ust.hk>; amit@...nel.org; arnd@...db.de; linux-kernel@...r.kernel.org
主题: Re: drivers/char: suspected null-pointer dereference problem in handle_control_message

On Tue, 2021-10-26 at 06:17 +0000, YE Chengfeng wrote:
> Hi,
>  
> https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith
> ub.com%2Ftorvalds%2Flinux%2Fblob%2Fmaster%2Fdrivers%2Fchar%2Fvirtio_co
> nsole.c%23L1657&amp;data=04%7C01%7Ccyeaa%40connect.ust.hk%7Ccfdf9c167c
> 6749fe336a08d9986ba318%7C6c1d415239d044ca88d9b8d6ddca0708%7C1%7C0%7C63
> 7708410345384834%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV
> 2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=GBDIMmW7FA1kawm
> SoKAH7xTW92%2BrHMo2i2SVR42XFqE%3D&amp;reserved=0
>  
> Our experimental static analysis tool detects a suspected null-pointer-dereference problem. We manually check it, but It still could be false positive because we are not familiar with the code. We report this to you just in case.
>  
> We notice that in some branches of switch case at line #1582, the pointer port is null check. But null check is missing at line #1657 and line #1633. It seems like a suspected null-pointer dereference pointer. Would you like to spare some time to have a look at it?

For this NULL deref to happen, the host will have to send a port_name command before a port_add command.  Worrying about that isn't worthwhile.  If you'd like to add a generic `if (unlikely(!port))` after line 1579 there, that'd be fine as a hint to the static analysis tools, though, so just for that reason, it might be worthwhile.

		Amit