linux-kernel - 回复: 回复: drivers/char: suspected null-pointer dereference problem in handle_control

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <TYCP286MB11883A093F13CDBEEF7827118A889@TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM>
Date:   Sat, 30 Oct 2021 13:20:38 +0000
From:   YE Chengfeng <cyeaa@...nect.ust.hk>
To:     Amit Shah <amit@...radead.org>,
        "amit@...nel.org" <amit@...nel.org>,
        "arnd@...db.de" <arnd@...db.de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: 回复: 回复: drivers/char: suspected null-pointer dereference problem in handle_control_message

If it's possible as said, maybe it should be fixed? 
Do you need my help to send a patch?

-----邮件原件-----
发件人: Amit Shah <amit@...radead.org> 
发送时间: 2021年10月28日 19:55
收件人: YE Chengfeng <cyeaa@...nect.ust.hk>; amit@...nel.org; arnd@...db.de; linux-kernel@...r.kernel.org
主题: Re: 回复: drivers/char: suspected null-pointer dereference problem in handle_control_message

On Tue, 2021-10-26 at 11:51 +0000, YE Chengfeng wrote:
> Thanks for your reply.
> 
> Agree with you, seems that the branch at #line 1573 already handles this situation.
> 
> Another question, is it possible that port->name is null when show_port_name is invoked? I don't see any null-check there, could it be a null-dereference problem at #line 1282? Link is below.
> https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftorvalds%2Flinux%2Fblob%2Fmaster%2Fdrivers%2Fchar%2Fvirtio_console.c%23L1282&amp;data=04%7C01%7Ccyeaa%40connect.ust.hk%7Cf78df542482244275a4408d99a09c159%7C6c1d415239d044ca88d9b8d6ddca0708%7C1%7C0%7C637710188967881644%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=TGc89qYoAYheHQOvDkMCpAtvNJz6muw9zC8nhQXAQ0E%3D&amp;reserved=0

Why don't you try it?

It's certainly possible that a port doesn't have a name.