linux-kernel - Re: [PATCH] clk: mediatek: mt6779: Fix a NULL pointer dereference in clk_mt6779_top

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 1 Dec 2021 17:33:21 +0800
From:   <miles.chen@...iatek.com>
To:     <zhou1615@....edu>
CC:     <kjlu@....edu>, <linux-arm-kernel@...ts.infradead.org>,
        <linux-clk@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linux-mediatek@...ts.infradead.org>, <matthias.bgg@...il.com>,
        <miles.chen@...iatek.com>, <mturquette@...libre.com>,
        <sboyd@...nel.org>, <wendell.lin@...iatek.com>
Subject: Re: [PATCH] clk: mediatek: mt6779: Fix a NULL pointer dereference in clk_mt6779_top_probe()

Hi Qingyang,

> Fix this bug by adding a check of clk_data.
> 
> Another way to fix this bug is to add a check of clk_data in
> mtk_clk_register_muxes(), which may solve many similar bugs but could
> cause potential problems to previously correct cases as the API is changed.
> 
> This bug was found by a static analyzer. The analysis employs
> differential checking to identify inconsistent security operations
> (e.g., checks or kfrees) between two code paths and confirms that the
> inconsistent operations are not recovered in the current function or
> the callers, so they constitute bugs.
> 
> Note that, as a bug found by static analysis, it can be a false
> positive or hard to trigger. Multiple researchers have cross-reviewed
> the bug.
> 
> Builds with CONFIG_COMMON_CLK_MT6779=y show no new warnings,
> and our static analyzer no longer warns about this code.
> 
> Fixes: 710774e04861 ("clk: mediatek: Add MT6779 clock support")
> Signed-off-by: Zhou Qingyang <zhou1615@....edu>
>

thanks,
Reviewed-by: Miles Chen <miles.chen@...iatek.com>