linux-kernel - Re: [PATCH] media: stkwebcam: move stk_camera_read_reg() scratch buffer to struct stk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 13 Mar 2022 08:35:40 -0700
From:   Tom Rix <trix@...hat.com>
To:     Pavel Skripkin <paskripkin@...il.com>, mchehab@...nel.org,
        hverkuil-cisco@...all.nl, cai.huoqing@...ux.dev,
        xose.vazquez@...il.com
Cc:     linux-media@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] media: stkwebcam: move stk_camera_read_reg() scratch
 buffer to struct stk_camera


On 3/13/22 8:11 AM, Pavel Skripkin wrote:
> Hi Tom,
>
> On 3/13/22 02:48, Tom Rix wrote:
>> These do show up in my usual static analysis and it why I was looking at
>> this file.
>>
>> And was sidetracked by the short malloc.
>>
>> Unfortunately I looked and there are many other similar instances
>> treewide ~100
>>
>
> Most of them are in very old drivers and I don't think they ever be 
> fixed. I've looked into one bug reported by syzkaller and there was 
> like 30 calls w/o proper error handling in one driver. Redoing whole 
> driver logic without access to hw seems dangerous :))

 From the checkpatch change below, there are about 150 dinky allocs treewide

Here is a refactoring

https://lore.kernel.org/lkml/20220313141008.1503638-1-trix@redhat.com/

>
>
>> These aren't caught in checkpatch, so working on that..
>>
>
> I think, it's not checkpath responsibility. Maybe it worth adding such 
> check to smatch. I tried to implement such checker, but never finished 
> it :(
>
>
Poking new development to not do dinky allocs I think is worth it, here 
is my checkpatch patch

https://lore.kernel.org/lkml/20220313140827.1503359-1-trix@redhat.com/

steal the regex for smatch.

Tom

>
> With regards,
> Pavel Skripkin
>