All of lore.kernel.org
 help / color / mirror / Atom feed
* re: misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge
@ 2021-05-18 18:32 Colin Ian King
  2021-05-18 19:22 ` Tong Zhang
  2021-05-18 19:28 ` [PATCH v4] " Tong Zhang
  0 siblings, 2 replies; 7+ messages in thread
From: Colin Ian King @ 2021-05-18 18:32 UTC (permalink / raw)
  To: Tong Zhang, Greg Kroah-Hartman; +Cc: Arnd Bergmann, linux-kernel

Hi,

Static analysis on linux-next with Coverity has detected an issue in
drivers/misc/cardreader/alcor_pci.c in function
alcor_pci_init_check_aspm  with the following commit:

commit 3ce3e45cc333da707d4d6eb433574b990bcc26f5
Author: Tong Zhang <ztong0001@gmail.com>
Date:   Thu May 13 00:07:33 2021 -0400

    misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge

The analysis is as follows:

135 static void alcor_pci_init_check_aspm(struct alcor_pci_priv *priv)
136 {
137        struct pci_dev *pci;
138        int where;
139        u32 val32;
140
141        priv->pdev_cap_off    = alcor_pci_find_cap_offset(priv,
priv->pdev);
142        /*
143         * A device might be attached to root complex directly and
144         * priv->parent_pdev will be NULL. In this case we don't
check its
145         * capability and disable ASPM completely.
146         */

   1. Condition !priv->parent_pdev, taking true branch.
   2. var_compare_op: Comparing priv->parent_pdev to null implies that
priv->parent_pdev might be null.

147        if (!priv->parent_pdev)

   Dereference after null check (FORWARD_NULL)
   3. var_deref_model: Passing null pointer priv->parent_pdev to
alcor_pci_find_cap_offset, which dereferences it.

148                priv->parent_cap_off = alcor_pci_find_cap_offset(priv,
149
priv->parent_pdev);

When !priv->parent_pdev is true, then priv->parent_pdev is NULL and
hence the call to alcor_pci_find_cap_offset() is dereferencing a null
pointer in the priv->parent_pdev argument.

I suspect the logic in the if statement is inverted, the ! should be
removed. This seems too trivial to be wrong. Maybe I'm missing something
deeper.

Colin


^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2021-05-22  4:40 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-18 18:32 misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge Colin Ian King
2021-05-18 19:22 ` Tong Zhang
2021-05-18 19:28 ` [PATCH v4] " Tong Zhang
2021-05-21 12:44   ` Greg Kroah-Hartman
2021-05-21 14:51     ` Tong Zhang
2021-05-22  4:37     ` [PATCH v1] misc: alcor_pci: fix inverted branch condition Tong Zhang
2021-05-22  4:40     ` [PATCH v4] misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge Tong Zhang

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.