linux-kernel - Re: [PATCH v4] cxl: Fix possible null pointer dereference in read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6c50de6d-7f35-4427-bd11-5f02f5e90c08@web.de>
Date: Mon, 15 Jul 2024 15:18:56 +0200
From: Markus Elfring <Markus.Elfring@....de>
To: make24@...as.ac.cn, linuxppc-dev@...ts.ozlabs.org,
 kernel-janitors@...r.kernel.org
Cc: stable@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>,
 Aleksandr Mishin <amishin@...rgos.ru>, Andrew Donnellan <ajd@...ux.ibm.com>,
 Arnd Bergmann <arnd@...db.de>, Frederic Barrat <fbarrat@...ux.ibm.com>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Ian Munsie <imunsie@....ibm.com>, Maxime Ripard <mripard@...nel.org>,
 Michael Ellerman <mpe@...erman.id.au>, Shuah Khan <shuah@...nel.org>,
 Wei Liu <wei.liu@...nel.org>
Subject: Re: [PATCH v4] cxl: Fix possible null pointer dereference in
 read_handle()

> In read_handle(), of_get_address() may return NULL if getting address and
> size of the node failed. When of_read_number() uses prop to handle
> conversions between different byte orders, it could lead to a null pointer
> dereference. Add NULL check to fix potential issue.
>
> Found by static analysis.
>
> Cc: stable@...r.kernel.org
> Fixes: 14baf4d9c739 ("cxl: Add guest-specific code")
> Signed-off-by: Ma Ke <make24@...as.ac.cn>

How will interests evolve for caring more according to known research
and development processes?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.10#n398
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/researcher-guidelines.rst?h=v6.10#n5


> ---
> Changes in v4:
> - modified vulnerability description according to suggestions, making the
> process of static analysis of vulnerabilities clearer. No active research
> on developer behavior.
…

Does such information indicate any communication difficulties?

Regards,
Markus