From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751525AbdHDJ0Q (ORCPT <rfc822;w@1wt.eu>);
        Fri, 4 Aug 2017 05:26:16 -0400
Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:58311 "EHLO
        mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL)
        by vger.kernel.org with ESMTP id S1751285AbdHDJ0P (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 4 Aug 2017 05:26:15 -0400
Date: Fri, 4 Aug 2017 11:26:08 +0200
From: Heiko Carstens <heiko.carstens@de.ibm.com>
To: sohu0106 <sohu0106@126.com>
Cc: schwidefsky@de.ibm.com, linux-s390@vger.kernel.org,
        torvalds@linux-foundation.org, linux-kernel@vger.kernel.org
Subject: Re: drivers/s390/char/keyboard.c NULL pointer reference
References: <3b10f99f.aa01.15da8632dec.Coremail.sohu0106@126.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <3b10f99f.aa01.15da8632dec.Coremail.sohu0106@126.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
X-TM-AS-GCONF: 00
x-cbid: 17080409-0012-0000-0000-0000056B27E6
X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused
x-cbparentid: 17080409-0013-0000-0000-000018E0F635
Message-Id: <20170804092608.GB3278@osiris>
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-08-04_05:,,
 signatures=0
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0
 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam
 adjust=0 reason=mlx scancount=1 engine=8.0.1-1706020000
 definitions=main-1708040140
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Aug 03, 2017 at 09:57:38PM +0800, sohu0106 wrote:
> 
> 
> Local users able to send the NULL arg argument to kbd_ioctl(), which could cause kernel crash
> 
> 
> 
> 
> diff --git a/keyboard.c 
> b/keyboard.c
> index ba0e4f9..3ec16b1 100644
> --- a/keyboard.c
> +++ b/keyboard.c
> @@ -456,6 +456,8 @@ int kbd_ioctl(struct kbd_data *kbd, unsigned int cmd, unsigned long arg)
>         int perm;
>  
>         argp = (void __user *)arg;
> +       if( !argp )
> +               return -EFAULT;

This doesn't make sense as well. All uaccess functions are able to handle
NULL pointers within user space.