lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <7ef732ad-a50f-4cf5-8322-376f42eb051b@moroto.mountain>
Date: Sat, 2 Mar 2024 12:59:39 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Mikhail Lobanov <m.lobanov@...alinux.ru>
Cc: Rui Miguel Silva <rmfrfs@...il.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	greybus-dev@...ts.linaro.org, linux-staging@...ts.linux.dev,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] greybus: Fix deref of NULL in
 __gb_lights_flash_brightness_set

On Fri, Mar 01, 2024 at 02:04:24PM -0500, Mikhail Lobanov wrote:
> Dereference of null pointer in the __gb_lights_flash_brightness_set function.
> Assigning the channel the result of executing the get_channel_from_mode function
> without checking for NULL may result in an error.

get_channel_from_mode() can only return NULL when light->channels_count
is zero.

Although get_channel_from_mode() seems buggy to me.  If it can't
find the correct mode, it just returns the last channel.  So potentially
it should be made to return NULL.

diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
index d62f97249aca..acd435f5d25d 100644
--- a/drivers/staging/greybus/light.c
+++ b/drivers/staging/greybus/light.c
@@ -95,15 +95,15 @@ static struct led_classdev *get_channel_cdev(struct gb_channel *channel)
 static struct gb_channel *get_channel_from_mode(struct gb_light *light,
 						u32 mode)
 {
-	struct gb_channel *channel = NULL;
+	struct gb_channel *channel;
 	int i;
 
 	for (i = 0; i < light->channels_count; i++) {
 		channel = &light->channels[i];
 		if (channel && channel->mode == mode)
-			break;
+			return channel;
 	}
-	return channel;
+	return NULL;
 }
 
 static int __gb_lights_flash_intensity_set(struct gb_channel *channel,

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ