netdev - Re: [RFC PATCH net-next 5/9] net: phylink: Add phylink_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 23 May 2019 22:55:22 +0100
From:   Russell King - ARM Linux admin <linux@...linux.org.uk>
To:     Ioana Ciornei <ioana.ciornei@....com>
Cc:     "f.fainelli@...il.com" <f.fainelli@...il.com>,
        "andrew@...n.ch" <andrew@...n.ch>,
        "hkallweit1@...il.com" <hkallweit1@...il.com>,
        "maxime.chevallier@...tlin.com" <maxime.chevallier@...tlin.com>,
        "olteanv@...il.com" <olteanv@...il.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "davem@...emloft.net" <davem@...emloft.net>
Subject: Re: [RFC PATCH net-next 5/9] net: phylink: Add phylink_create_raw

On Thu, May 23, 2019 at 01:20:40AM +0000, Ioana Ciornei wrote:
> +	if (pl->ops) {
> +		pl->ops->mac_link_up(ndev, pl->link_an_mode,
>  			     pl->phy_state.interface,
>  			     pl->phydev);
>  
> +		netif_carrier_on(ndev);
>  
> +		netdev_info(ndev,
> +			    "Link is Up - %s/%s - flow control %s\n",
> +			    phy_speed_to_str(link_state.speed),
> +			    phy_duplex_to_str(link_state.duplex),
> +			    phylink_pause_to_str(link_state.pause));
> +	} else {
> +		blocking_notifier_call_chain(&pl->notifier_chain,
> +					     PHYLINK_MAC_LINK_UP, &info);
> +		phydev_info(pl->phydev,
> +			    "Link is Up - %s/%s - flow control %s\n",
> +			    phy_speed_to_str(link_state.speed),
> +			    phy_duplex_to_str(link_state.duplex),
> +			    phylink_pause_to_str(link_state.pause));
> +	}

So if we don't have pl->ops, what happens when we call phydev_info()
with a NULL phydev, which is a very real possibility: one of phylink's
whole points is to support dynamic presence of a PHY.

What will happen in that case is this will oops, due to dereferencing
an offset NULL pointer via:

#define phydev_info(_phydev, format, args...)	\
	dev_info(&_phydev->mdio.dev, format, ##args)

You can't just decide that if there's no netdev, we will be guaranteed
a phy.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 12.1Mbps down 622kbps up
According to speedtest.net: 11.9Mbps down 500kbps up