linux-kernel - Re: [PATCH] irq: Fix uninitialized pointers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87tt4mok84.ffs@tglx>
Date: Wed, 11 Jun 2025 08:39:23 +0200
From: Thomas Gleixner <tglx@...utronix.de>
To: Gyeyoung Baek <gye976@...il.com>
Cc: linux-kernel@...r.kernel.org, Gyeyoung Baek <gye976@...il.com>
Subject: Re: [PATCH] irq: Fix uninitialized pointers

On Tue, May 27 2025 at 18:35, Gyeyoung Baek wrote:

The subject line prefix is wrong. See

https://www.kernel.org/doc/html/latest/process/maintainer-tip.html#patch-subject

> Fix uninitialized `ops` member's pointers to avoid kernel Oops in

You cannot fix an uninitialized pointer. You only can initialize it
properly.

> `irq_sim_request_resources()`.

No backticks required. fun() is clear on it's own.

Also please describe how this ends up with an oops in
irq_sim_request_resources(). The point is that any dereference of an
uninitialized pointer is resulting in a problem and it does not matter
where.

Dereferencing an uninitialized pointer can cause an Ooops or worse it
can call into some random code when the uninitialized memory contained a
valid pointer, which is way harder to debug than a plain crash.

> index 1a3d483548e2..67fd1de5d197 100644
> --- a/kernel/irq/irq_sim.c
> +++ b/kernel/irq/irq_sim.c
> @@ -222,8 +222,12 @@ struct irq_domain *irq_domain_create_sim_full(struct fwnode_handle *fwnode,
>  	work_ctx->pending = no_free_ptr(pending);
>  	work_ctx->user_data = data;
>  
> -	if (ops)
> +	if (ops) {
>  		memcpy(&work_ctx->ops, ops, sizeof(*ops));
> +	} else {
> +		work_ctx->ops.irq_sim_irq_released = NULL;
> +		work_ctx->ops.irq_sim_irq_requested = NULL;
> +	}

The obvious fix is way more simple. Just allocate work_ctx with
kzalloc() instead of kmalloc(), no?

Thanks,

        tglx