linux-kernel - Re: [PATCH v4 1/8] driver core: class: Fix wild pointer dereferences in API class_dev_iter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241223200941.00000111@huawei.com>
Date: Mon, 23 Dec 2024 20:09:41 +0000
From: Jonathan Cameron <Jonathan.Cameron@...wei.com>
To: Zijun Hu <zijun_hu@...oud.com>
CC: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, "Rafael J. Wysocki"
	<rafael@...nel.org>, Tejun Heo <tj@...nel.org>, Josef Bacik
	<josef@...icpanda.com>, Jens Axboe <axboe@...nel.dk>, Boris Burkov
	<boris@....io>, Davidlohr Bueso <dave@...olabs.net>, Dave Jiang
	<dave.jiang@...el.com>, Alison Schofield <alison.schofield@...el.com>, Vishal
 Verma <vishal.l.verma@...el.com>, Ira Weiny <ira.weiny@...el.com>, Dan
 Williams <dan.j.williams@...el.com>, <linux-kernel@...r.kernel.org>,
	<cgroups@...r.kernel.org>, <linux-block@...r.kernel.org>,
	<linux-cxl@...r.kernel.org>, Zijun Hu <quic_zijuhu@...cinc.com>
Subject: Re: [PATCH v4 1/8] driver core: class: Fix wild pointer
 dereferences in API class_dev_iter_next()

On Wed, 18 Dec 2024 08:01:31 +0800
Zijun Hu <zijun_hu@...oud.com> wrote:

> From: Zijun Hu <quic_zijuhu@...cinc.com>
> 
> There are a potential wild pointer dereferences issue regarding APIs
> class_dev_iter_(init|next|exit)(), as explained by below typical usage:
> 
> // All members of @iter are wild pointers.
> struct class_dev_iter iter;
> 
> // class_dev_iter_init(@iter, @class, ...) checks parameter @class for
> // potential class_to_subsys() error, and it returns void type and does
> // not initialize its output parameter @iter, so caller can not detect
> // the error and continues to invoke class_dev_iter_next(@iter) even if
> // @iter still contains wild pointers.
> class_dev_iter_init(&iter, ...);
> 
> // Dereference these wild pointers in @iter here once suffer the error.
> while (dev = class_dev_iter_next(&iter)) { ... };
> 
> // Also dereference these wild pointers here.
> class_dev_iter_exit(&iter);
> 
> Actually, all callers of these APIs have such usage pattern in kernel tree.
> Fix by:
> - Initialize output parameter @iter by memset() in class_dev_iter_init()
>   and give callers prompt by pr_crit() for the error.
> - Check if @iter is valid in class_dev_iter_next().
> 
> Fixes: 7b884b7f24b4 ("driver core: class.c: convert to only use class_to_subsys")
> Signed-off-by: Zijun Hu <quic_zijuhu@...cinc.com>

Your reply to earlier review made sense to me so I'm happy with this.

Reviewed-by: Jonathan Cameron <Jonathan.Cameron@...wei.com>

> 
> ---
> Alternative fix solutions ever thought about:
> 
> 1) Use BUG_ON(!sp) instead of error return in class_dev_iter_init().
> 2) Change class_dev_iter_init()'s type to int, lots of jobs to do.
> 
> This issue is APIs themself issues, and regardless of how various API
> users use them, and silent wild pointer dereferences are not what API
> users expect for the error absolutely.
> ---
>  drivers/base/class.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/base/class.c b/drivers/base/class.c
> index 582b5a02a5c410113326601fe00eb6d7231f988f..d57f277978dc9033fba3484b4620bcf884a4029f 100644
> --- a/drivers/base/class.c
> +++ b/drivers/base/class.c
> @@ -323,8 +323,12 @@ void class_dev_iter_init(struct class_dev_iter *iter, const struct class *class,
>  	struct subsys_private *sp = class_to_subsys(class);
>  	struct klist_node *start_knode = NULL;
>  
> -	if (!sp)
> +	memset(iter, 0, sizeof(*iter));
> +	if (!sp) {
> +		pr_crit("%s: class %p was not registered yet\n",
> +			__func__, class);
>  		return;
> +	}
>  
>  	if (start)
>  		start_knode = &start->p->knode_class;
> @@ -351,6 +355,9 @@ struct device *class_dev_iter_next(struct class_dev_iter *iter)
>  	struct klist_node *knode;
>  	struct device *dev;
>  
> +	if (!iter->sp)
> +		return NULL;
> +
>  	while (1) {
>  		knode = klist_next(&iter->ki);
>  		if (!knode)
>