* [PATCH] tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
@ 2022-04-10 11:48 Zheyu Ma
2022-04-11 10:12 ` Jiri Slaby
0 siblings, 1 reply; 3+ messages in thread
From: Zheyu Ma @ 2022-04-10 11:48 UTC (permalink / raw)
To: gregkh, jirislaby; +Cc: linux-kernel, Zheyu Ma
When the driver fails at alloc_hdlcdev(), and then we remove the driver
module, we will get the following splat:
[ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI
[ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]
[ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0
[ 25.077709] Call Trace:
[ 25.077924] <TASK>
[ 25.078108] unregister_hdlc_device+0x16/0x30
[ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]
Fix this by checking whether the 'info->netdev' is a null pointer first.
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
---
drivers/tty/synclink_gt.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
index 25c558e65ece..9bc2a9265277 100644
--- a/drivers/tty/synclink_gt.c
+++ b/drivers/tty/synclink_gt.c
@@ -1746,6 +1746,8 @@ static int hdlcdev_init(struct slgt_info *info)
*/
static void hdlcdev_exit(struct slgt_info *info)
{
+ if (!info->netdev)
+ return;
unregister_hdlc_device(info->netdev);
free_netdev(info->netdev);
info->netdev = NULL;
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
2022-04-10 11:48 [PATCH] tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() Zheyu Ma
@ 2022-04-11 10:12 ` Jiri Slaby
2022-04-11 10:46 ` Zheyu Ma
0 siblings, 1 reply; 3+ messages in thread
From: Jiri Slaby @ 2022-04-11 10:12 UTC (permalink / raw)
To: Zheyu Ma, gregkh; +Cc: linux-kernel
On 10. 04. 22, 13:48, Zheyu Ma wrote:
> When the driver fails at alloc_hdlcdev(), and then we remove the driver
> module, we will get the following splat:
>
> [ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI
> [ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]
> [ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0
> [ 25.077709] Call Trace:
> [ 25.077924] <TASK>
> [ 25.078108] unregister_hdlc_device+0x16/0x30
> [ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]
>
> Fix this by checking whether the 'info->netdev' is a null pointer first.
Hi,
LGTM
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Out of curiosity, do you use the driver, or you only do some static
analysis?
> Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
> ---
> drivers/tty/synclink_gt.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
> index 25c558e65ece..9bc2a9265277 100644
> --- a/drivers/tty/synclink_gt.c
> +++ b/drivers/tty/synclink_gt.c
> @@ -1746,6 +1746,8 @@ static int hdlcdev_init(struct slgt_info *info)
> */
> static void hdlcdev_exit(struct slgt_info *info)
> {
> + if (!info->netdev)
> + return;
> unregister_hdlc_device(info->netdev);
> free_netdev(info->netdev);
> info->netdev = NULL;
--
js
suse labs
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
2022-04-11 10:12 ` Jiri Slaby
@ 2022-04-11 10:46 ` Zheyu Ma
0 siblings, 0 replies; 3+ messages in thread
From: Zheyu Ma @ 2022-04-11 10:46 UTC (permalink / raw)
To: Jiri Slaby; +Cc: Greg KH, Linux Kernel Mailing List
On Mon, Apr 11, 2022 at 6:13 PM Jiri Slaby <jirislaby@kernel.org> wrote:
>
> On 10. 04. 22, 13:48, Zheyu Ma wrote:
> > When the driver fails at alloc_hdlcdev(), and then we remove the driver
> > module, we will get the following splat:
> >
> > [ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI
> > [ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]
> > [ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0
> > [ 25.077709] Call Trace:
> > [ 25.077924] <TASK>
> > [ 25.078108] unregister_hdlc_device+0x16/0x30
> > [ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]
> >
> > Fix this by checking whether the 'info->netdev' is a null pointer first.
>
> Hi,
>
> LGTM
>
> Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
>
> Out of curiosity, do you use the driver, or you only do some static
> analysis?
In fact, neither. I test the driver via fuzzing in a simulated environment.
Zheyu Ma
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-04-11 10:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-10 11:48 [PATCH] tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() Zheyu Ma
2022-04-11 10:12 ` Jiri Slaby
2022-04-11 10:46 ` Zheyu Ma
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).