linux-kernel - RE: [PATCH 1/2] misc/mei: Add NULL check to component match callback functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 28 Apr 2022 18:11:02 +0000
From:   "Winkler, Tomas" <tomas.winkler@...el.com>
To:     Won Chung <wonchung@...gle.com>,
        Heikki Krogerus <heikki.krogerus@...ux.intel.com>,
        "Usyskin, Alexander" <alexander.usyskin@...el.com>,
        Mika Westerberg <mika.westerberg@...ux.intel.com>,
        Benson Leung <bleung@...omium.org>,
        Prashant Malani <pmalani@...omium.org>,
        "Ceraolo Spurio, Daniele" <daniele.ceraolospurio@...el.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH 1/2] misc/mei: Add NULL check to component match callback
 functions

> 
> On Tue, Apr 19, 2022 at 2:59 AM Won Chung <wonchung@...gle.com>
> wrote:
> >
> > Currently, component_match callback functions used in mei refers to
> > the driver name, assuming that the component device being matched has
> > a driver bound. It can cause a NULL pointer dereference when a device
> > without a driver bound registers a component. This is due to the
> > nature of the component framework where all registered components are
> > matched in any component_match callback functions. So even if a
> > component is registered by a totally irrelevant device, that component
> > is also shared to these callbacks for i915 driver.
> >
> > To prevent totally irrelevant device being matched for i915 and
> > causing a NULL pointer dereference for checking driver name, add a
> > NULL check on
> > dev->driver to check if there is a driver bound before checking the
> > driver name.
> >
> > In the future, the string compare on the driver name, "i915" may need
> > to be refactored too.
> >
> > Reviewed-by: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
> > Reviewed-by: Prashant Malani <pmalani@...omium.org>
> > Signed-off-by: Won Chung <wonchung@...gle.com>
Acked-by: Tomas Winkler <tomas.winkler@...el.com> 

> > ---
> >  drivers/misc/mei/hdcp/mei_hdcp.c | 2 +-
> >  drivers/misc/mei/pxp/mei_pxp.c   | 2 +-
> >  2 files changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c
> > b/drivers/misc/mei/hdcp/mei_hdcp.c
> > index ec2a4fce8581..e889a8bd7ac8 100644
> > --- a/drivers/misc/mei/hdcp/mei_hdcp.c
> > +++ b/drivers/misc/mei/hdcp/mei_hdcp.c
> > @@ -784,7 +784,7 @@ static int mei_hdcp_component_match(struct
> device
> > *dev, int subcomponent,  {
> >         struct device *base = data;
> >
> > -       if (strcmp(dev->driver->name, "i915") ||
> > +       if (!dev->driver || strcmp(dev->driver->name, "i915") ||
> >             subcomponent != I915_COMPONENT_HDCP)
> >                 return 0;
> >
> > diff --git a/drivers/misc/mei/pxp/mei_pxp.c
> > b/drivers/misc/mei/pxp/mei_pxp.c index f7380d387bab..5c39457e3f53
> > 100644
> > --- a/drivers/misc/mei/pxp/mei_pxp.c
> > +++ b/drivers/misc/mei/pxp/mei_pxp.c
> > @@ -131,7 +131,7 @@ static int mei_pxp_component_match(struct device
> > *dev, int subcomponent,  {
> >         struct device *base = data;
> >
> > -       if (strcmp(dev->driver->name, "i915") ||
> > +       if (!dev->driver || strcmp(dev->driver->name, "i915") ||
> >             subcomponent != I915_COMPONENT_PXP)
> >                 return 0;
> >
> > --
> > 2.36.0.rc0.470.gd361397f0d-goog
> >
> 
> Hi Tomas,
> 
> I am adding you to this patch since you are the maintainer of MEI.
> If this looks okay to you, could you also take a look at the comment thread on
> the cover letter and give an ack if it is okay to be merged into thunderbolt
> tree?
> https://lore.kernel.org/all/20220418175932.1809770-1-
> wonchung@...gle.com/
> 
> Thank you,
> Won