linux-kernel - Re: [PATCH] misc: uacce - add the null check for the input pointer and its pointer members

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2251e63b-01f9-415f-bae3-9c64b7d7a7ac@huawei.com>
Date: Sat, 30 Mar 2024 15:10:14 +0800
From: huangchenghai <huangchenghai2@...wei.com>
To: Greg KH <gregkh@...uxfoundation.org>
CC: <zhangfei.gao@...aro.org>, <wangzhou1@...ilicon.com>,
	<linux-kernel@...r.kernel.org>, <linux-crypto@...r.kernel.org>,
	<fanghao11@...wei.com>, <shenyang39@...wei.com>, <liulongfang@...wei.com>,
	<qianweili@...wei.com>
Subject: Re: [PATCH] misc: uacce - add the null check for the input pointer
 and its pointer members


在 2024/3/30 15:01, Greg KH 写道:
> On Sat, Mar 30, 2024 at 11:34:24AM +0800, huangchenghai wrote:
>> On Fri, Mar 29, 2024 at2:34PM, Greg KH wrote:
>>
>>> On Fri, Mar 29, 2024 at 02:26:55PM +0800, Chenghai Huang wrote:
>>>> The uacce_alloc() is the member of the EXPORT_SYMBOL_GPL. Therefore, null
>>>> pointer verification is added on the pointer type input parameter and its
>>>> pointer members.
>>> I do not understand, why does the export type matter?  Just fix any
>>> callers to use this properly and send proper parameters.  What in-tree
>>> caller needs this?
>>>
>>> thanks,
>>>
>>> greg k-h
>> The interface defined by the export type seems important and the input
>> parameters need to be verified.
> The export type does not matter at all.
>
>> But I understand from your mail that this is the job of the caller.
> Exactly.
>
>> By the way, I still have a confusion. Interfaces like ioctrl, debugfs, read,
>> or write require parameter validation. so what kind of kernel interfaces require
>> parameter validation? Is there a definition?
> Some do, some do not, it depends on the situation.  If data comes from
> an untrusted source (i.e. outside the kernel), then it MUST be validated
> (remember "all input is evil"), but if it's from within the kernel,
> usually it does not.
>
> thanks,
>
> greg k-h

I get it, thank you very much.

thanks,

Chenghai