linux-kernel - Re: [PATCH v2] cxl: Fix possible null pointer dereference in read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2024071052-squad-glorify-0830@gregkh>
Date: Wed, 10 Jul 2024 12:59:52 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Ma Ke <make24@...as.ac.cn>
Cc: fbarrat@...ux.ibm.com, ajd@...ux.ibm.com, arnd@...db.de,
	clombard@...ux.vnet.ibm.com, imunsie@....ibm.com,
	mpe@...erman.id.au, manoj@...ux.vnet.ibm.com,
	linuxppc-dev@...ts.ozlabs.org, linux-kernel@...r.kernel.org,
	stable@...r.kernel.org
Subject: Re: [PATCH v2] cxl: Fix possible null pointer dereference in
 read_handle()

On Wed, Jul 10, 2024 at 06:33:52PM +0800, Ma Ke wrote:
> In read_handle(), of_get_address() may return NULL which is later
> dereferenced. Fix this by adding NULL check.
> 
> Cc: stable@...r.kernel.org
> Fixes: 14baf4d9c739 ("cxl: Add guest-specific code")
> Signed-off-by: Ma Ke <make24@...as.ac.cn>
> ---
> Changes in v2:
> - The potential vulnerability was discovered as follows: based on our 
> customized static analysis tool, extract vulnerability features[1], and 
> then match similar vulnerability features in this function.

You need to follow the rules outlined in
Documentation/process/researcher-guidelines.rst when doing stuff like
this.  Otherwise all of your patches will have to be rejected.

Please fix up the changelog text of all of the patches you have
submitted recently to follow those rules.

thanks,

greg k-h