On Wed, 18 Dec 2024 08:01:31 +0800
Zijun Hu <zijun_hu@xxxxxxxxxx> wrote:
> From: Zijun Hu <quic_zijuhu@xxxxxxxxxxx>
>
> There are a potential wild pointer dereferences issue regarding APIs
> class_dev_iter_(init|next|exit)(), as explained by below typical usage:
>
> // All members of @iter are wild pointers.
> struct class_dev_iter iter;
>
> // class_dev_iter_init(@iter, @class, ...) checks parameter @class for
> // potential class_to_subsys() error, and it returns void type and does
> // not initialize its output parameter @iter, so caller can not detect
> // the error and continues to invoke class_dev_iter_next(@iter) even if
> // @iter still contains wild pointers.
> class_dev_iter_init(&iter, ...);
>
> // Dereference these wild pointers in @iter here once suffer the error.
> while (dev = class_dev_iter_next(&iter)) { ... };
>
> // Also dereference these wild pointers here.
> class_dev_iter_exit(&iter);
>
> Actually, all callers of these APIs have such usage pattern in kernel tree.
> Fix by:
> - Initialize output parameter @iter by memset() in class_dev_iter_init()
> and give callers prompt by pr_crit() for the error.
> - Check if @iter is valid in class_dev_iter_next().
>
> Fixes: 7b884b7f24b4 ("driver core: class.c: convert to only use class_to_subsys")
> Signed-off-by: Zijun Hu <quic_zijuhu@xxxxxxxxxxx>
Your reply to earlier review made sense to me so I'm happy with this.
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
>
> ---
> Alternative fix solutions ever thought about:
>
> 1) Use BUG_ON(!sp) instead of error return in class_dev_iter_init().
> 2) Change class_dev_iter_init()'s type to int, lots of jobs to do.
>
> This issue is APIs themself issues, and regardless of how various API
> users use them, and silent wild pointer dereferences are not what API
> users expect for the error absolutely.
> ---
> drivers/base/class.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/base/class.c b/drivers/base/class.c
> index 582b5a02a5c410113326601fe00eb6d7231f988f..d57f277978dc9033fba3484b4620bcf884a4029f 100644
> --- a/drivers/base/class.c
> +++ b/drivers/base/class.c
> @@ -323,8 +323,12 @@ void class_dev_iter_init(struct class_dev_iter *iter, const struct class *class,
> struct subsys_private *sp = class_to_subsys(class);
> struct klist_node *start_knode = NULL;
>
> - if (!sp)
> + memset(iter, 0, sizeof(*iter));
> + if (!sp) {
> + pr_crit("%s: class %p was not registered yet\n",
> + __func__, class);
> return;
> + }
>
> if (start)
> start_knode = &start->p->knode_class;
> @@ -351,6 +355,9 @@ struct device *class_dev_iter_next(struct class_dev_iter *iter)
> struct klist_node *knode;
> struct device *dev;
>
> + if (!iter->sp)
> + return NULL;
> +
> while (1) {
> knode = klist_next(&iter->ki);
> if (!knode)
>
