linux-kernel - Re: [PATCH][next] drm/xe/guc: Fix dereference before Null check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEO-vhEGtBX1sb3MYm18+MBGEgrFfNpzatBT46kcN9_Wh=NFMQ@mail.gmail.com>
Date: Wed, 9 Oct 2024 14:49:55 -0600
From: "Everest K.C." <everestkc@...restkc.com.np>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: lucas.demarchi@...el.com, thomas.hellstrom@...ux.intel.com, 
	rodrigo.vivi@...el.com, maarten.lankhorst@...ux.intel.com, mripard@...nel.org, 
	tzimmermann@...e.de, airlied@...il.com, simona@...ll.ch, 
	skhan@...uxfoundation.org, intel-xe@...ts.freedesktop.org, 
	dri-devel@...ts.freedesktop.org, kernel-janitors@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH][next] drm/xe/guc: Fix dereference before Null check

On Wed, Oct 9, 2024 at 2:35 PM Dan Carpenter <dan.carpenter@...aro.org> wrote:
>
> On Wed, Oct 09, 2024 at 12:49:49PM -0600, Everest K.C. wrote:
> > The pointer list->list was derefrenced before the Null check
> > resulting in possibility of Null pointer derefrencing.
> > This patch moves the Null check outside the for loop, so that
> > the check is performed before the derefrencing.
> >
> > This issue was reported by Coverity Scan.
> >
> > Signed-off-by: Everest K.C. <everestkc@...restkc.com.np>
>
> You need to add a Fixes tag.
Will add it and send a V2.
> > ---
> >  drivers/gpu/drm/xe/xe_guc_capture.c | 6 +++---
> >  1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/xe/xe_guc_capture.c b/drivers/gpu/drm/xe/xe_guc_capture.c
> > index 41262bda20ed..de63c622747d 100644
> > --- a/drivers/gpu/drm/xe/xe_guc_capture.c
> > +++ b/drivers/gpu/drm/xe/xe_guc_capture.c
> > @@ -1537,13 +1537,13 @@ read_reg_to_node(struct xe_hw_engine *hwe, const struct __guc_mmio_reg_descr_gro
> >       if (!regs)
> >               return;
> >
> > +     if (!list->list)
> > +             return;
>
> Could you merge this with the other sanity checks at the start of the function.
>
> -       if (!list || list->num_regs == 0)
> +       if (!list || !list->list || list->num_regs == 0)
That looks better. Will do that in V2 and send it.
> The list->list pointer can't actually be NULL.  It comes from
> guc_capture_get_one_list(), so if the reglists[i].list pointer is NULL it
> returns NULL.  However, obviously checking for NULL after a dereference is not
> the correct so it's worth fixing and probably deserves a Fixes tag.  Although it
> doesn't affect runtime, adding a Fixes tag helps backporters know they can
> automatically ignore this one because the commit it's fixing is very recent.
>
> regards,
> dan carpenter
>