linux-kernel - Re: soc: mediatek: SVS: introduce MTK SVS engine

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e09a4f5e-8fbf-be3b-85af-a6dad347f67f@gmail.com>
Date:   Wed, 22 Jun 2022 15:37:38 +0200
From:   Matthias Brugger <matthias.bgg@...il.com>
To:     "Colin King (gmail)" <colin.i.king@...il.com>,
        Roger Lu <roger.lu@...iatek.com>
Cc:     AngeloGioacchino Del Regno 
        <angelogioacchino.delregno@...labora.com>,
        Kevin Hilman <khilman@...libre.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: soc: mediatek: SVS: introduce MTK SVS engine

Hi Colin,

On 22/06/2022 14:02, Colin King (gmail) wrote:
> Hi,
> 
> static analysis on linux-next with clang scan-build has detected a null pointer 
> dereference in the following commit:
> 
> commit 681a02e9500073cd8b9c25a04f06166254b5a879
> Author: Roger Lu <roger.lu@...iatek.com>
> Date:   Mon May 16 08:43:07 2022 +0800
> 
>      soc: mediatek: SVS: introduce MTK SVS engine
> 
> 
> The issue is as follows:
> 
> static irqreturn_t svs_isr(int irq, void *data)
> {
>          struct svs_platform *svsp = data;
>          struct svs_bank *svsb = NULL;
>          unsigned long flags;
>          u32 idx, int_sts, svs_en;
> 
>          for (idx = 0; idx < svsp->bank_max; idx++) {
>                  svsb = &svsp->banks[idx];
>                  WARN(!svsb, "%s: svsb(%s) is null", __func__, svsb->name);
>                  spin_lock_irqsave(&svs_lock, flags);
>                  svsp->pbank = svsb;
> 
> 
> If svsb is null, then the WARN message will dereference it when printing 
> svsb->name.  Also, subsequent dereferences to sbsv will cause a null pointer 
> dereference, for example the svsp->pbank assignment.
> 
> Colin

The banks and bank_max are defined on a per SoC basis in the platform data [1]. 
The case that svsb is null would hint to a incorrect platform data. So I think 
that there is no real issue we need to fix.

Regards,
Matthias


[1] 
https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux.git/tree/drivers/soc/mediatek/mtk-svs.c?h=v5.19-next/soc#n2237