lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20250506162820.GV3339421@horms.kernel.org>
Date: Tue, 6 May 2025 17:28:20 +0100
From: Simon Horman <horms@...nel.org>
To: Siddarth G <siddarthsgml@...il.com>
Cc: andrew+netdev@...n.ch, davem@...emloft.net, edumazet@...gle.com,
	kuba@...nel.org, pabeni@...hat.com, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, skhan@...uxfoundation.org
Subject: Re: [PATCH] fddi/skfp: fix null pointer dereference in smt.c

On Mon, May 05, 2025 at 02:40:25PM +0530, Siddarth G wrote:
> In smt_string_swap(), when a closing bracket ']' is encountered
> before any opening bracket '[' open_paren would be NULL,
> and assigning it to format would lead to a null pointer being
> dereferenced in the format++ statement.
> 
> Add a check to verify open_paren is non-NULL before assigning
> it to format
> 
> Fixes: CID 100271 (Coverity Scan)

* If there is a public link for the issue, then I think
  it would be appropriate to include it in a "closes: "
  tag.

  Else, I think it would be best to simply state something like
  "This issue was reported by Coverity Scan."

* The Fixes: tag should (only) refer to the commit that
  introduced the bug. In this case it looks like the bug goes
  all the way back to the beginning of git history.
  If so the tag should cite the very first commit.

  Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

* Please don't leave a space between the Fixes tag and Signed-off-by tag.
  (Or between any other tags.)

* Assuming this is a but, please target it at the net tree like this:

  Subject: [PATCH net v2] ...

  Patches for net should have a Fixes tag.

  Otherwise the patch should be targeted at the net-next tree.
  And there should not be a Fixes tag.

* If you post a v2, please observe the 24 hour rule

  https://docs.kernel.org/process/maintainer-netdev.html

> 
> Signed-off-by: Siddarth G <siddarthsgml@...il.com>

Please consider expanding G out to the name it is short for
(assuming that is the case) both in the Signed-off-by line and From address.

Thanks.

> ---
>  drivers/net/fddi/skfp/smt.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/fddi/skfp/smt.c b/drivers/net/fddi/skfp/smt.c
> index dd15af4e98c2..174f279b89ac 100644
> --- a/drivers/net/fddi/skfp/smt.c
> +++ b/drivers/net/fddi/skfp/smt.c
> @@ -1857,7 +1857,8 @@ static void smt_string_swap(char *data, const char *format, int len)
>  			open_paren = format ;
>  			break ;
>  		case ']' :
> -			format = open_paren ;
> +			if (open_paren)
> +				format = open_paren ;
>  			break ;
>  		case '1' :
>  		case '2' :
> -- 
> 2.43.0

-- 
pw-bot: changes-requested

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ