Re: [PATCH v4 1/8] driver core: class: Fix wild pointer dereferences in API class_dev_iter_next()

[Jonathan Cameron <Jonathan.Cameron@huawei.com>]

On Wed, 18 Dec 2024 08:01:31 +0800
Zijun Hu <zijun_hu@icloud.com> wrote:

> From: Zijun Hu <quic_zijuhu@quicinc.com>
> 
> There are a potential wild pointer dereferences issue regarding APIs
> class_dev_iter_(init|next|exit)(), as explained by below typical usage:
> 
> // All members of @iter are wild pointers.
> struct class_dev_iter iter;
> 
> // class_dev_iter_init(@iter, @class, ...) checks parameter @class for
> // potential class_to_subsys() error, and it returns void type and does
> // not initialize its output parameter @iter, so caller can not detect
> // the error and continues to invoke class_dev_iter_next(@iter) even if
> // @iter still contains wild pointers.
> class_dev_iter_init(&iter, ...);
> 
> // Dereference these wild pointers in @iter here once suffer the error.
> while (dev = class_dev_iter_next(&iter)) { ... };
> 
> // Also dereference these wild pointers here.
> class_dev_iter_exit(&iter);
> 
> Actually, all callers of these APIs have such usage pattern in kernel tree.
> Fix by:
> - Initialize output parameter @iter by memset() in class_dev_iter_init()
>   and give callers prompt by pr_crit() for the error.
> - Check if @iter is valid in class_dev_iter_next().
> 
> Fixes: 7b884b7f24b4 ("driver core: class.c: convert to only use class_to_subsys")
> Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>

Your reply to earlier review made sense to me so I'm happy with this.

Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

> 
> ---
> Alternative fix solutions ever thought about:
> 
> 1) Use BUG_ON(!sp) instead of error return in class_dev_iter_init().
> 2) Change class_dev_iter_init()'s type to int, lots of jobs to do.
> 
> This issue is APIs themself issues, and regardless of how various API
> users use them, and silent wild pointer dereferences are not what API
> users expect for the error absolutely.
> ---
>  drivers/base/class.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/base/class.c b/drivers/base/class.c
> index 582b5a02a5c410113326601fe00eb6d7231f988f..d57f277978dc9033fba3484b4620bcf884a4029f 100644
> --- a/drivers/base/class.c
> +++ b/drivers/base/class.c
> @@ -323,8 +323,12 @@ void class_dev_iter_init(struct class_dev_iter *iter, const struct class *class,
>  	struct subsys_private *sp = class_to_subsys(class);
>  	struct klist_node *start_knode = NULL;
>  
> -	if (!sp)
> +	memset(iter, 0, sizeof(*iter));
> +	if (!sp) {
> +		pr_crit("%s: class %p was not registered yet\n",
> +			__func__, class);
>  		return;
> +	}
>  
>  	if (start)
>  		start_knode = &start->p->knode_class;
> @@ -351,6 +355,9 @@ struct device *class_dev_iter_next(struct class_dev_iter *iter)
>  	struct klist_node *knode;
>  	struct device *dev;
>  
> +	if (!iter->sp)
> +		return NULL;
> +
>  	while (1) {
>  		knode = klist_next(&iter->ki);
>  		if (!knode)
>