linux-kernel - Re: [PATCH 6.1.y] ssb: Fix potential NULL pointer dereference in ssb_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025022412-unlikable-aftermost-bc2a@gregkh>
Date: Mon, 24 Feb 2025 13:54:10 +0100
From: Greg KH <gregkh@...uxfoundation.org>
To: jianqi.ren.cn@...driver.com
Cc: stable@...r.kernel.org, patches@...ts.linux.dev, kvalo@...nel.org,
	rand.sec96@...il.com, m@...s.ch, linux-wireless@...r.kernel.org,
	linux-kernel@...r.kernel.org, zhe.he@...driver.com
Subject: Re: [PATCH 6.1.y] ssb: Fix potential NULL pointer dereference in
 ssb_device_uevent()

On Mon, Feb 24, 2025 at 04:37:07PM +0800, jianqi.ren.cn@...driver.com wrote:
> From: Rand Deeb <rand.sec96@...il.com>
> 
> [ Upstream commit 789c17185fb0f39560496c2beab9b57ce1d0cbe7 ]
> 
> The ssb_device_uevent() function first attempts to convert the 'dev' pointer
> to 'struct ssb_device *'. However, it mistakenly dereferences 'dev' before
> performing the NULL check, potentially leading to a NULL pointer
> dereference if 'dev' is NULL.
> 
> To fix this issue, move the NULL check before dereferencing the 'dev' pointer,
> ensuring that the pointer is valid before attempting to use it.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Signed-off-by: Rand Deeb <rand.sec96@...il.com>
> Signed-off-by: Kalle Valo <kvalo@...nel.org>
> Link: https://msgid.link/20240306123028.164155-1-rand.sec96@gmail.com
> Signed-off-by: Jianqi Ren <jianqi.ren.cn@...driver.com>
> Signed-off-by: He Zhe <zhe.he@...driver.com>
> ---
> Verified the build test.
> ---
>  drivers/ssb/main.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
> index d52e91258e98..aae50a5dfb57 100644
> --- a/drivers/ssb/main.c
> +++ b/drivers/ssb/main.c
> @@ -341,11 +341,13 @@ static int ssb_bus_match(struct device *dev, struct device_driver *drv)
>  
>  static int ssb_device_uevent(struct device *dev, struct kobj_uevent_env *env)
>  {
> -	struct ssb_device *ssb_dev = dev_to_ssb_dev(dev);
> +	struct ssb_device *ssb_dev;
>  
>  	if (!dev)
>  		return -ENODEV;
>  
> +	ssb_dev = dev_to_ssb_dev(dev);

This patch does nothing, sorry.  It's impossible for dev to be null so
no need to verify this and I guess I'll go reject the cve that was
assigned to it as well as it's pointless.

thanks,

greg k-h