linux-kernel - Re: [PATCH] tpm: Move dereference after NULL check in tpm_buf_check_hmac

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <D2QVZB1Y4DHT.2WFLXMCFYSISM@iki.fi>
Date: Tue, 16 Jul 2024 13:20:46 +0300
From: "Jarkko Sakkinen" <jarkko.sakkinen@....fi>
To: "Hao Ge" <hao.ge@...ux.dev>, "Jarkko Sakkinen" <jarkko@...nel.org>,
 <peterhuewe@....de>, <jgg@...pe.ca>
Cc: <linux-integrity@...r.kernel.org>, <linux-kernel@...r.kernel.org>, "Hao
 Ge" <gehao@...inos.cn>
Subject: Re: [PATCH] tpm: Move dereference after NULL check in
 tpm_buf_check_hmac_response

On Tue Jul 16, 2024 at 4:04 AM EEST, Hao Ge wrote:
> Hi Jarkko
>
> Have a nice day.
>
> On 7/15/24 19:25, Jarkko Sakkinen wrote:
> > On Tue Jul 9, 2024 at 5:33 AM EEST, Hao Ge wrote:
> >> From: Hao Ge <gehao@...inos.cn>
> >>
> >> We shouldn't dereference "auth" until after we have checked that it is
> >> non-NULL.
> >>
> >> Fixes: 7ca110f2679b ("tpm: Address !chip->auth in tpm_buf_append_hmac_session*()")
> >> Signed-off-by: Hao Ge <gehao@...inos.cn>
> > Also lacking:
> >
> > Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
> > Closes: https://lore.kernel.org/linux-integrity/3b1755a9-b12f-42fc-b26d-de2fe4e13ec2@stanley.mountain/T/#u
>
> Regarding this version, I don't think I should add these.
>
> I send this patch on July 9th, 2024.
>
> The following email was sent on July 13th, 2024.
>
> https://lore.kernel.org/linux-integrity/3b1755a9-b12f-42fc-b26d-de2fe4e13ec2@stanley.mountain/T/#u
>
> I think these should be included in the subsequent versions (if any).

OK sorry, then you are right.

>
> >
> > What is happening here is that my commit exposed pre-existing bug to
> > static analysis but it did not introduce a new regression. I missed
> > from your patch how did you ended up to your conclusions.
> >
> > Please *do not* ignore the sources next time. Either explain how the bug
> > was found or provide the reporting source. You are essentially taking
> > credit and also blame from the work that you did not accomplish
> > yourself, which is both wrong and dishonest.
> >
> > BR, Jarkko
>
> OK,got it,I'll pay more attention to such details in the future.
>
> I would like to clarify that I did not taking credit and dishonest.

OK, cool, and I do agree, and I'm sorry what I said.

Please just add the necessary details and send v2 then.

BRR, Jarkko