linux-kernel - Re: [PATCH] char: tty3270: fix a missing check on list iterator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20220328071251.24865-1-xiam0nd.tong@gmail.com>
Date:   Mon, 28 Mar 2022 15:12:51 +0800
From:   Xiaomeng Tong <xiam0nd.tong@...il.com>
To:     svens@...ux.ibm.com
Cc:     agordeev@...ux.ibm.com, borntraeger@...ux.ibm.com,
        dsterba@...e.com, elder@...aro.org, gor@...ux.ibm.com,
        gregkh@...uxfoundation.org, hca@...ux.ibm.com, jcmvbkbc@...il.com,
        jirislaby@...nel.org, linux-kernel@...r.kernel.org,
        linux-s390@...r.kernel.org, stable@...r.kernel.org,
        xiam0nd.tong@...il.com
Subject: Re: [PATCH] char: tty3270: fix a missing check on list iterator

On  Mon, 28 Mar 2022 08:01:02 +0200,  Sven Schnelle wrote:
> > diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
> > index 5c83f71c1d0e..030e9a098d11 100644
> > --- a/drivers/s390/char/tty3270.c
> > +++ b/drivers/s390/char/tty3270.c
> > @@ -1111,7 +1111,7 @@ tty3270_convert_line(struct tty3270 *tp, int line_nr)
> >  {
> >  	struct tty3270_line *line;
> >  	struct tty3270_cell *cell;
> > -	struct string *s, *n;
> > +	struct string *s = NULL, *n, *iter;
> >  	unsigned char highlight;
> >  	unsigned char f_color;
> >  	char *cp;
> > @@ -1142,13 +1142,15 @@ tty3270_convert_line(struct tty3270 *tp, int line_nr)
> >  
> >  	/* Find the line in the list. */
> >  	i = tp->view.rows - 2 - line_nr;
> > -	list_for_each_entry_reverse(s, &tp->lines, list)
> > -		if (--i <= 0)
> > +	list_for_each_entry_reverse(iter, &tp->lines, list)
> > +		if (--i <= 0) {
> > +			s = iter;
> >  			break;
> > +		}
> >  	/*
> >  	 * Check if the line needs to get reallocated.
> >  	 */
> > -	if (s->len != flen) {
> > +	if (!s || s->len != flen) {
> 
> This doesn't look right. You're checking for s == NULL here
> 
> >  		/* Reallocate string. */
> >  		n = tty3270_alloc_string(tp, flen);
> >  		list_add(&n->list, &s->list);
> 
> and if it is NULL, list_add() would be called here.

Yes, you are right, i have submitted PATCH v2 to fix it, thank you.

--
Xiaomeng Tong