linux-kernel - Re: [PATCH] misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CA+JzhdLrVVarF8+xV3KhMvKCR9a35tAAJEvdSzAEv-gAw14wbQ@mail.gmail.com>
Date: Thu, 11 Dec 2025 11:18:16 -0800
From: Scott Branden <scott.branden@...adcom.com>
To: Tuo Li <islituo@...il.com>
Cc: bcm-kernel-feedback-list@...adcom.com, arnd@...db.de, 
	gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()

Hi Tuo,

On Wed, Dec 10, 2025 at 10:36 PM Tuo Li <islituo@...il.com> wrote:
>
> In the function bcm_vk_read(), the pointer entry is checked, indicating
> that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
> following code may cause null-pointer dereferences:
>
>   struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
>   set_msg_id(&tmp_msg, entry->usr_msg_id);
>   tmp_msg.size = entry->to_h_blks - 1;
>
> To prevent these possible null-pointer dereferences, copy to_h_msg,
> usr_msg_id, and to_h_blks from iter into temporary variables, and return
> these temporary variables to the application instead of accessing them
> through a potentially NULL entry.
>
> Signed-off-by: Tuo Li <islituo@...il.com>
> ---
>  drivers/misc/bcm-vk/bcm_vk_msg.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c
> index 1f42d1d5a630..665a3888708a 100644
> --- a/drivers/misc/bcm-vk/bcm_vk_msg.c
> +++ b/drivers/misc/bcm-vk/bcm_vk_msg.c
> @@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file,
>         struct device *dev = &vk->pdev->dev;
>         struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan;
>         struct bcm_vk_wkent *entry = NULL, *iter;
> +       struct vk_msg_blk tmp_msg;
> +       u32 tmp_usr_msg_id;
> +       u32 tmp_blks;
>         u32 q_num;
>         u32 rsp_length;
>
> @@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file,
>                                         entry = iter;
>                                 } else {
>                                         /* buffer not big enough */
> +                                       tmp_msg = iter->to_h_msg[0];
> +                                       tmp_usr_msg_id = iter->usr_msg_id;
> +                                       tmp_blks = iter->to_h_blks;
>                                         rc = -EMSGSIZE;
>                                 }
>                                 goto read_loop_exit;
> @@ -1052,14 +1058,12 @@ ssize_t bcm_vk_read(struct file *p_file,
>
>                 bcm_vk_free_wkent(dev, entry);
>         } else if (rc == -EMSGSIZE) {
> -               struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
> -
>                 /*
>                  * in this case, return just the first block, so
>                  * that app knows what size it is looking for.
>                  */
> -               set_msg_id(&tmp_msg, entry->usr_msg_id);
> -               tmp_msg.size = entry->to_h_blks - 1;
You can just change entry to iter on these 2 lines here?

> +               set_msg_id(&tmp_msg, tmp_usr_msg_id);
> +               tmp_msg.size = tmp_blks - 1;
>                 if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) {
>                         dev_err(dev, "Error return 1st block in -EMSGSIZE\n");
>                         rc = -EFAULT;
> --
> 2.43.0
>

Download attachment "smime.p7s" of type "application/pkcs7-signature" (5473 bytes)