| Message ID | 20190729092424.30928-1-baijiaju1990@gmail.com |
|---|---|
| State | Superseded |
| Delegated to: | David Miller |
| Headers | show |
| Series | net: phy: phy_led_triggers: Fix a possible null-pointer dereference in phy_led_trigger_change_speed() | expand |
On Mon, Jul 29, 2019 at 05:24:24PM +0800, Jia-Ju Bai wrote: > In phy_led_trigger_change_speed(), there is an if statement on line 48 > to check whether phy->last_triggered is NULL: > if (!phy->last_triggered) > > When phy->last_triggered is NULL, it is used on line 52: > led_trigger_event(&phy->last_triggered->trigger, LED_OFF); > > Thus, a possible null-pointer dereference may occur. > > To fix this bug, led_trigger_event(&phy->last_triggered->trigger, > LED_OFF) is called when phy->last_triggered is not NULL. > > This bug is found by a static analysis tool STCheck written by us. Who is 'us'? Thanks Andrew
On 2019/7/29 21:45, Andrew Lunn wrote: > On Mon, Jul 29, 2019 at 05:24:24PM +0800, Jia-Ju Bai wrote: >> In phy_led_trigger_change_speed(), there is an if statement on line 48 >> to check whether phy->last_triggered is NULL: >> if (!phy->last_triggered) >> >> When phy->last_triggered is NULL, it is used on line 52: >> led_trigger_event(&phy->last_triggered->trigger, LED_OFF); >> >> Thus, a possible null-pointer dereference may occur. >> >> To fix this bug, led_trigger_event(&phy->last_triggered->trigger, >> LED_OFF) is called when phy->last_triggered is not NULL. >> >> This bug is found by a static analysis tool STCheck written by us. > Who is 'us'? Me and my colleague... Best wishes, Jia-Ju Bai
On Tue, Jul 30, 2019 at 10:25:36AM +0800, Jia-Ju Bai wrote: > > > On 2019/7/29 21:45, Andrew Lunn wrote: > >On Mon, Jul 29, 2019 at 05:24:24PM +0800, Jia-Ju Bai wrote: > >>In phy_led_trigger_change_speed(), there is an if statement on line 48 > >>to check whether phy->last_triggered is NULL: > >> if (!phy->last_triggered) > >> > >>When phy->last_triggered is NULL, it is used on line 52: > >> led_trigger_event(&phy->last_triggered->trigger, LED_OFF); > >> > >>Thus, a possible null-pointer dereference may occur. > >> > >>To fix this bug, led_trigger_event(&phy->last_triggered->trigger, > >>LED_OFF) is called when phy->last_triggered is not NULL. > >> > >>This bug is found by a static analysis tool STCheck written by us. > >Who is 'us'? > > Me and my colleague... Well, we can leave it very vague, giving no idea who 'us' is. But often you want to name the company behind it, or the university, or the sponsor, etc. Andrew
From: Andrew Lunn <andrew@lunn.ch> Date: Tue, 30 Jul 2019 05:32:29 +0200 > On Tue, Jul 30, 2019 at 10:25:36AM +0800, Jia-Ju Bai wrote: >> >> >> On 2019/7/29 21:45, Andrew Lunn wrote: >> >On Mon, Jul 29, 2019 at 05:24:24PM +0800, Jia-Ju Bai wrote: >> >>In phy_led_trigger_change_speed(), there is an if statement on line 48 >> >>to check whether phy->last_triggered is NULL: >> >> if (!phy->last_triggered) >> >> >> >>When phy->last_triggered is NULL, it is used on line 52: >> >> led_trigger_event(&phy->last_triggered->trigger, LED_OFF); >> >> >> >>Thus, a possible null-pointer dereference may occur. >> >> >> >>To fix this bug, led_trigger_event(&phy->last_triggered->trigger, >> >>LED_OFF) is called when phy->last_triggered is not NULL. >> >> >> >>This bug is found by a static analysis tool STCheck written by us. >> >Who is 'us'? >> >> Me and my colleague... > > Well, we can leave it very vague, giving no idea who 'us' is. But > often you want to name the company behind it, or the university, or > the sponsor, etc. I agree, if you are going to mention that there is a tool you should be clear exactly who and what organization are behind it. Thank you.
On 2019/7/30 11:41, David Miller wrote: > From: Andrew Lunn <andrew@lunn.ch> > Date: Tue, 30 Jul 2019 05:32:29 +0200 > >> On Tue, Jul 30, 2019 at 10:25:36AM +0800, Jia-Ju Bai wrote: >>> >>> On 2019/7/29 21:45, Andrew Lunn wrote: >>>> On Mon, Jul 29, 2019 at 05:24:24PM +0800, Jia-Ju Bai wrote: >>>>> In phy_led_trigger_change_speed(), there is an if statement on line 48 >>>>> to check whether phy->last_triggered is NULL: >>>>> if (!phy->last_triggered) >>>>> >>>>> When phy->last_triggered is NULL, it is used on line 52: >>>>> led_trigger_event(&phy->last_triggered->trigger, LED_OFF); >>>>> >>>>> Thus, a possible null-pointer dereference may occur. >>>>> >>>>> To fix this bug, led_trigger_event(&phy->last_triggered->trigger, >>>>> LED_OFF) is called when phy->last_triggered is not NULL. >>>>> >>>>> This bug is found by a static analysis tool STCheck written by us. >>>> Who is 'us'? >>> Me and my colleague... >> Well, we can leave it very vague, giving no idea who 'us' is. But >> often you want to name the company behind it, or the university, or >> the sponsor, etc. > I agree, if you are going to mention that there is a tool you should be > clear exactly who and what organization are behind it Thanks for the advice. I will add my organization in the patch. Best wishes, Jia-Ju Bai
diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c index b86a4b2116f8..59a94e07e7c5 100644 --- a/drivers/net/phy/phy_led_triggers.c +++ b/drivers/net/phy/phy_led_triggers.c @@ -48,8 +48,9 @@ void phy_led_trigger_change_speed(struct phy_device *phy) if (!phy->last_triggered) led_trigger_event(&phy->led_link_trigger->trigger, LED_FULL); + else + led_trigger_event(&phy->last_triggered->trigger, LED_OFF); - led_trigger_event(&phy->last_triggered->trigger, LED_OFF); led_trigger_event(&plt->trigger, LED_FULL); phy->last_triggered = plt; }
In phy_led_trigger_change_speed(), there is an if statement on line 48 to check whether phy->last_triggered is NULL: if (!phy->last_triggered) When phy->last_triggered is NULL, it is used on line 52: led_trigger_event(&phy->last_triggered->trigger, LED_OFF); Thus, a possible null-pointer dereference may occur. To fix this bug, led_trigger_event(&phy->last_triggered->trigger, LED_OFF) is called when phy->last_triggered is not NULL. This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- drivers/net/phy/phy_led_triggers.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)