From: Joshua Hawking <joshuahawking1@gmail.com>
To: linux-um@lists.infradead.org
Subject: [PATCH] um: Fix null pointer dereference when parsing ubd commandline arguments
Date: Sat, 2 Jan 2021 14:03:52 +0000 [thread overview]
Message-ID: <0c7b460e-1929-bf42-2ade-f99f97d45428@gmail.com> (raw)
From: Adam Watson (aw414141@gmail.com)
When passing one or two arguments to ubd during UML setup - i.e.
ubd0=File or ubd0=File,Backing_File - the parsing code introduced in commit
ef3ba87cb7c9 ("um: ubd: Set device serial attribute from cmdline") does
not check
whether strsep consumed the entire string without finding a delimeter
last time
it was called (and so has set str to NULL, causing the next output of strsep
on that string to be NULL) before attempting to dereference the output of it
inside the if statements. For example, with two arguments (and only 1
comma/colon), serial will be NULL, and (*serial == '\0') causes a null
pointer
dereference.
Signed-off-by: Adam Watson (aw414141@gmail.com)
Signed-off-by: Joshua Hawking (joshuahawking1@gmail.com)
Tested-by: Joshua Hawking (joshuahawking1@gmail.com)
Fixes: ef3ba87cb7c9 ("um: ubd: Set device serial attribute from cmdline")
---
--- b/arch/um/drivers/ubd_kern.c 2021-01-02 13:13:55.995018942 +0000
+++ a/arch/um/drivers/ubd_kern.c 2021-01-02 13:16:16.847023905 +0000
@@ -375,11 +375,11 @@ break_loop:
file = NULL;
backing_file = strsep(&str, ",:");
- if (*backing_file == '\0')
+ if (backing_file && *backing_file == '\0')
backing_file = NULL;
serial = strsep(&str, ",:");
- if (*serial == '\0')
+ if (serial && *serial == '\0')
serial = NULL;
if (backing_file && ubd_dev->no_cow) {
_______________________________________________
linux-um mailing list
linux-um@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-um
next reply other threads:[~2021-01-02 14:03 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-02 14:03 Joshua Hawking [this message]
2021-01-02 14:08 ` [PATCH] um: Fix null pointer dereference when parsing ubd commandline arguments Christopher Obbard
2021-01-02 14:11 ` Joshua Hawking
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0c7b460e-1929-bf42-2ade-f99f97d45428@gmail.com \
--to=joshuahawking1@gmail.com \
--cc=linux-um@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox