linux-kernel - Re: [PATCH RESEND] EDAC/altera: Fix possible null pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <7021a08b-ba75-4d16-a71f-b38e48df5af3@amd.com>
Date: Fri, 2 Aug 2024 01:01:07 -0500
From: "Naik, Avadhut" <avadnaik@....com>
To: Ma Ke <make24@...as.ac.cn>, dinguyen@...nel.org, bp@...en8.de,
 tony.luck@...el.com, james.morse@....com, mchehab@...nel.org,
 rric@...nel.org, niravkumar.l.rabara@...el.com
Cc: linux-edac@...r.kernel.org, linux-kernel@...r.kernel.org,
 stable@...r.kernel.org
Subject: Re: [PATCH RESEND] EDAC/altera: Fix possible null pointer dereference

On 8/1/2024 22:38, Ma Ke wrote:
> In altr_s10_sdram_check_ecc_deps(), of_get_address() may return NULL which
> is later dereferenced. Fix this bug by adding NULL check.
> 
Only of_get_address() has been mentioned here but the patch also tries to
fix a possible NULL pointer dereference arising from of_translate_address().
Also, a some context on how this was discovered might be helpful.

> Cc: stable@...r.kernel.org
> Fixes: e1bca853dddc ("EDAC/altera: Add SDRAM ECC check for U-Boot")
> Signed-off-by: Ma Ke <make24@...as.ac.cn>
> ---
>  drivers/edac/altera_edac.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c
> index fe89f5c4837f..d6bf0eebeb41 100644
> --- a/drivers/edac/altera_edac.c
> +++ b/drivers/edac/altera_edac.c
> @@ -1086,6 +1086,7 @@ static int altr_s10_sdram_check_ecc_deps(struct altr_edac_device_dev *device)
>  	struct arm_smccc_res result;
>  	struct device_node *np;
>  	phys_addr_t sdram_addr;
> +	const __be32 *sdram_addrp;
>  	u32 read_reg;
>  	int ret;
>  
> @@ -1093,8 +1094,14 @@ static int altr_s10_sdram_check_ecc_deps(struct altr_edac_device_dev *device)
>  	if (!np)
>  		goto sdram_err;
>  
> -	sdram_addr = of_translate_address(np, of_get_address(np, 0,
> -							     NULL, NULL));
> +	sdram_addrp = of_get_address(np, 0, NULL, NULL);
> +	if (!sdram_addrp)
> +		return -EINVAL;
> +
> +	sdram_addr = of_translate_address(np, sdram_addrp);
> +	if (!sdram_addr)
> +		return -EINVAL;
> +
Will sdram_addr here ever be NULL?
IIUC, of_translate_address() will return OF_BAD_ADDR in case the translation fails.
Perhaps, a more prudent check here, if required, would be

	if (sdram_addr == OF_BAD_ADDR)

-- 
Thanks,
Avadhut Naik