* Re: [PATCH][next] acpi/hmat: fix uninitialized pointer dereference on pointer 'target'
2019-04-05 14:12 [PATCH][next] acpi/hmat: fix uninitialized pointer dereference on pointer 'target' Colin King
@ 2019-04-05 15:38 ` Keith Busch
2019-04-05 16:06 ` Mukesh Ojha
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Keith Busch @ 2019-04-05 15:38 UTC (permalink / raw)
To: Colin King
Cc: Rafael J . Wysocki, Len Brown, Greg Kroah-Hartman, Busch, Keith,
linux-acpi@vger.kernel.org, kernel-janitors@vger.kernel.org,
linux-kernel@vger.kernel.org
On Fri, Apr 05, 2019 at 07:12:15AM -0700, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The pointer 'target' is not initialized and is only assigned when the
> ACPI_HMAT_MEMORY_PD_VALID bit in p->flags is set. There is a later null
> check on target that leads to an uninitialized pointer read and
> dereference when assigning target->processor_pxm when target contains a
> non-null garbage value. Fix this by initializing targer to null.
>
> Fixes: 665ac7e92757 ("acpi/hmat: Register processor domain to its memory")
> Addresses-Coverity: ("Uninitialized pointer read")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
I would have sworn this was fixed as it's in my tree already, but the
submitted patch sure enough doesn't have it.
I've double checked to see if there are any other discrepencies, and
there are no other differences after this.
Thanks for the fix!
Reviewed-by: Keith Busch <keith.busch@intel.com>
> ---
> drivers/acpi/hmat/hmat.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/hmat/hmat.c b/drivers/acpi/hmat/hmat.c
> index b7824a0309f7..b275016ff648 100644
> --- a/drivers/acpi/hmat/hmat.c
> +++ b/drivers/acpi/hmat/hmat.c
> @@ -366,7 +366,7 @@ static int __init hmat_parse_proximity_domain(union acpi_subtable_headers *heade
> const unsigned long end)
> {
> struct acpi_hmat_proximity_domain *p = (void *)header;
> - struct memory_target *target;
> + struct memory_target *target = NULL;
>
> if (p->header.length != sizeof(*p)) {
> pr_notice("HMAT: Unexpected address range header length: %d\n",
> --
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH][next] acpi/hmat: fix uninitialized pointer dereference on pointer 'target'
2019-04-05 14:12 [PATCH][next] acpi/hmat: fix uninitialized pointer dereference on pointer 'target' Colin King
2019-04-05 15:38 ` Keith Busch
@ 2019-04-05 16:06 ` Mukesh Ojha
2019-04-09 3:28 ` Nathan Chancellor
2019-04-09 7:51 ` Rafael J. Wysocki
3 siblings, 0 replies; 5+ messages in thread
From: Mukesh Ojha @ 2019-04-05 16:06 UTC (permalink / raw)
To: Colin King, Rafael J . Wysocki, Len Brown, Greg Kroah-Hartman,
Keith Busch, linux-acpi
Cc: kernel-janitors, linux-kernel
On 4/5/2019 7:42 PM, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The pointer 'target' is not initialized and is only assigned when the
> ACPI_HMAT_MEMORY_PD_VALID bit in p->flags is set. There is a later null
> check on target that leads to an uninitialized pointer read and
> dereference when assigning target->processor_pxm when target contains a
> non-null garbage value. Fix this by initializing targer to null.
>
> Fixes: 665ac7e92757 ("acpi/hmat: Register processor domain to its memory")
> Addresses-Coverity: ("Uninitialized pointer read")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
Cheers,
-Mukesh
> ---
> drivers/acpi/hmat/hmat.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/hmat/hmat.c b/drivers/acpi/hmat/hmat.c
> index b7824a0309f7..b275016ff648 100644
> --- a/drivers/acpi/hmat/hmat.c
> +++ b/drivers/acpi/hmat/hmat.c
> @@ -366,7 +366,7 @@ static int __init hmat_parse_proximity_domain(union acpi_subtable_headers *heade
> const unsigned long end)
> {
> struct acpi_hmat_proximity_domain *p = (void *)header;
> - struct memory_target *target;
> + struct memory_target *target = NULL;
>
> if (p->header.length != sizeof(*p)) {
> pr_notice("HMAT: Unexpected address range header length: %d\n",
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH][next] acpi/hmat: fix uninitialized pointer dereference on pointer 'target'
2019-04-05 14:12 [PATCH][next] acpi/hmat: fix uninitialized pointer dereference on pointer 'target' Colin King
2019-04-05 15:38 ` Keith Busch
2019-04-05 16:06 ` Mukesh Ojha
@ 2019-04-09 3:28 ` Nathan Chancellor
2019-04-09 7:51 ` Rafael J. Wysocki
3 siblings, 0 replies; 5+ messages in thread
From: Nathan Chancellor @ 2019-04-09 3:28 UTC (permalink / raw)
To: Colin King
Cc: Rafael J . Wysocki, Len Brown, Greg Kroah-Hartman, Keith Busch,
linux-acpi, kernel-janitors, linux-kernel
On Fri, Apr 05, 2019 at 03:12:15PM +0100, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The pointer 'target' is not initialized and is only assigned when the
> ACPI_HMAT_MEMORY_PD_VALID bit in p->flags is set. There is a later null
> check on target that leads to an uninitialized pointer read and
> dereference when assigning target->processor_pxm when target contains a
> non-null garbage value. Fix this by initializing targer to null.
>
> Fixes: 665ac7e92757 ("acpi/hmat: Register processor domain to its memory")
> Addresses-Coverity: ("Uninitialized pointer read")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
> ---
> drivers/acpi/hmat/hmat.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/hmat/hmat.c b/drivers/acpi/hmat/hmat.c
> index b7824a0309f7..b275016ff648 100644
> --- a/drivers/acpi/hmat/hmat.c
> +++ b/drivers/acpi/hmat/hmat.c
> @@ -366,7 +366,7 @@ static int __init hmat_parse_proximity_domain(union acpi_subtable_headers *heade
> const unsigned long end)
> {
> struct acpi_hmat_proximity_domain *p = (void *)header;
> - struct memory_target *target;
> + struct memory_target *target = NULL;
>
> if (p->header.length != sizeof(*p)) {
> pr_notice("HMAT: Unexpected address range header length: %d\n",
> --
> 2.20.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH][next] acpi/hmat: fix uninitialized pointer dereference on pointer 'target'
2019-04-05 14:12 [PATCH][next] acpi/hmat: fix uninitialized pointer dereference on pointer 'target' Colin King
` (2 preceding siblings ...)
2019-04-09 3:28 ` Nathan Chancellor
@ 2019-04-09 7:51 ` Rafael J. Wysocki
3 siblings, 0 replies; 5+ messages in thread
From: Rafael J. Wysocki @ 2019-04-09 7:51 UTC (permalink / raw)
To: Colin King, Greg Kroah-Hartman
Cc: Rafael J . Wysocki, Len Brown, Keith Busch,
ACPI Devel Maling List, kernel-janitors,
Linux Kernel Mailing List
On Fri, Apr 5, 2019 at 4:12 PM Colin King <colin.king@canonical.com> wrote:
>
> From: Colin Ian King <colin.king@canonical.com>
>
> The pointer 'target' is not initialized and is only assigned when the
> ACPI_HMAT_MEMORY_PD_VALID bit in p->flags is set. There is a later null
> check on target that leads to an uninitialized pointer read and
> dereference when assigning target->processor_pxm when target contains a
> non-null garbage value. Fix this by initializing targer to null.
>
> Fixes: 665ac7e92757 ("acpi/hmat: Register processor domain to its memory")
> Addresses-Coverity: ("Uninitialized pointer read")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Greg, since the patch fixed by this one is in your tree, can you apply
this too, please?
> ---
> drivers/acpi/hmat/hmat.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/hmat/hmat.c b/drivers/acpi/hmat/hmat.c
> index b7824a0309f7..b275016ff648 100644
> --- a/drivers/acpi/hmat/hmat.c
> +++ b/drivers/acpi/hmat/hmat.c
> @@ -366,7 +366,7 @@ static int __init hmat_parse_proximity_domain(union acpi_subtable_headers *heade
> const unsigned long end)
> {
> struct acpi_hmat_proximity_domain *p = (void *)header;
> - struct memory_target *target;
> + struct memory_target *target = NULL;
>
> if (p->header.length != sizeof(*p)) {
> pr_notice("HMAT: Unexpected address range header length: %d\n",
> --
> 2.20.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread