linux-kernel - Re: [PATCH] ASoC: test-component: fix null pointer dereference.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20211206092937.GA5609@hamza-OptiPlex-7040>
Date:   Mon, 6 Dec 2021 14:29:37 +0500
From:   Ameer Hamza <amhamza.mgc@...il.com>
To:     Kuninori Morimoto <kuninori.morimoto.gx@...esas.com>
Cc:     "lgirdwood@...il.com" <lgirdwood@...il.com>,
        "broonie@...nel.org" <broonie@...nel.org>,
        "perex@...ex.cz" <perex@...ex.cz>,
        "tiwai@...e.com" <tiwai@...e.com>,
        "alsa-devel@...a-project.org" <alsa-devel@...a-project.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] ASoC: test-component: fix null pointer dereference.

On Sun, Dec 05, 2021 at 10:40:27PM +0000, Kuninori Morimoto wrote:
> 
> Hi Ameer
> 
> Thank you for your patch.
> 
> > Dereferncing of_id pointer will result in exception in current
> > implementation since of_match_device() will assign it to NULL.
> > Adding NULL check for protection.
> (snip)
> > @@ -532,13 +532,16 @@ static int test_driver_probe(struct platform_device *pdev)
> >  	struct device_node *node = dev->of_node;
> >  	struct device_node *ep;
> >  	const struct of_device_id *of_id = of_match_device(test_of_match, &pdev->dev);
> > -	const struct test_adata *adata = of_id->data;
> > +	const struct test_adata *adata;
> >  	struct snd_soc_component_driver *cdriv;
> >  	struct snd_soc_dai_driver *ddriv;
> >  	struct test_dai_name *dname;
> >  	struct test_priv *priv;
> >  	int num, ret, i;
> >  
> > +	if (!of_id)
> > +		return -EINVAL;
> > +	adata = of_id->data;
> 
> But hmm...
> Probing this driver without adata is strange for me.
> How did probe this driver ??
Thank you for your response. Unfortunately, I am not aware of
implementation details of this component. Coverity suggested that there
can be a potential NULL pointer access which seems logical to me. Do you
agree with coverity here?

> 
> Best regards
> ---
> Kuninori Morimoto