linux-kernel - Re: [PATCH] dmaengine: idxd: Fix dereference on uninitialized pointer conf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aJnC8CLkQLnY-ZPr@stanley.mountain>
Date: Mon, 11 Aug 2025 13:16:16 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Colin Ian King <colin.i.king@...il.com>,
	Shuai Xue <xueshuai@...ux.alibaba.com>
Cc: Vinicius Costa Gomes <vinicius.gomes@...el.com>,
	Dave Jiang <dave.jiang@...el.com>, Vinod Koul <vkoul@...nel.org>,
	Fenghua Yu <fenghuay@...dia.com>,
	Shuai Xue <xueshuai@...ux.alibaba.com>, dmaengine@...r.kernel.org,
	kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] dmaengine: idxd: Fix dereference on uninitialized
 pointer conf_dev

On Mon, Aug 11, 2025 at 10:58:36AM +0100, Colin Ian King wrote:
> Currently if the allocation for wq fails on the initial iteration in
> the setup loop the error exit path to err will call put_device on
> an uninitialized pointer conf_dev. Fix this by initializing conf_dev
> to NULL, note that put_device will ignore a NULL device pointer so no
> null pointer dereference issues occur on this call.
> 
> Fixes: 3fd2f4bc010c ("dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs")
> 
> Signed-off-by: Colin Ian King <colin.i.king@...il.com>
> ---

No.  This isn't the right fix.  I basically wrote out the correct fix
in my bug report:
https://lore.kernel.org/all/aDQt3_rZjX-VuHJW@stanley.mountain/
Shuai Xue sent a fix as well but that patch wasn't right either but I
didn't review it until now.

It's easiest if I send the fix and give you Reported-by credit.

regards,
dan carpenter