netdev - Re: [PATCH] net: sh_eth: avoid NULL pointer dereference in ring setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 2 Mar 2016 19:47:05 +0300
From:	Sergei Shtylyov <sergei.shtylyov@...entembedded.com>
To:	Wolfram Sang <wsa@...-dreams.de>, netdev@...r.kernel.org
Cc:	Simon Horman <horms@...ge.net.au>,
	linux-renesas-soc@...r.kernel.org
Subject: Re: [PATCH] net: sh_eth: avoid NULL pointer dereference in ring setup

Hello.

On 03/02/2016 06:26 PM, Wolfram Sang wrote:

> From: Wolfram Sang <wsa+renesas@...g-engineering.com>
>
> When allocating an skb fails, rxdesc is still NULL (or the previous ring
> index on further iterations of the loop). However, this pointer is
> dereferenced after the loop.

    This is intended. What we seem to actually need is a NULL check before 
that dereference.

> So, make sure rxdesc is updated immediately
> at the beginning of the loop.

    No, this seems wrong. We don't want an unfilled descriptor to be marked as 
last, we still need the previous one marked as last. Actually, 'rxdesc' 
shouldn't be "advanced" even before the second *break* as it is now.

> Reported-by: coverity (CID 1056464)
> Signed-off-by: Wolfram Sang <wsa+renesas@...g-engineering.com>

    Will you respin or should I?

MBR, Sergei