linux-kernel - Re: [PATCH] nfsroot: Fix missing check for return value of strsep()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <43531410-F066-4DE9-9FA7-990D2E5D878B@redhat.com>
Date:   Wed, 14 Jun 2023 11:23:19 -0400
From:   Benjamin Coddington <bcodding@...hat.com>
To:     Chenyuan Mi <cymi20@...an.edu.cn>
Cc:     trond.myklebust@...merspace.com, anna@...nel.org,
        linux-nfs@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] nfsroot: Fix missing check for return value of strsep()

On 14 Jun 2023, at 10:30, Chenyuan Mi wrote:

> The strsep() function in root_nfs_parse_options() may return NULL
> if argument 'incoming' is NULL. Since 'incoming' has Null check in
> this function, it is also need to add Null check for return value
>  of strsep().

Incoming is checked to be non-NULL *before* sending it to strsep() here.

> Found by our static analysis tool.

The tool must be noticing that it is checked for NULL *after* strsep(),
which wouldn't matter to strsep() at all.

Ben