Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <a61be974ef65d00fd22b0216fc0d85c0c226f5e9.camel@infradead.org>
Subject: Re: drivers/char: suspected null-pointer dereference problem in
 handle_control_message
From:   Amit Shah <amit@infradead.org>
To:     YE Chengfeng <cyeaa@connect.ust.hk>,
        "amit@kernel.org" <amit@kernel.org>,
        "arnd@arndb.de" <arnd@arndb.de>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Date:   Tue, 26 Oct 2021 12:29:31 +0200
In-Reply-To: <TYCP286MB11884B1010AF8C77F1BBDAF08A849@TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM>
References: <TYCP286MB11884B1010AF8C77F1BBDAF08A849@TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Tue, 2021-10-26 at 06:17 +0000, YE Chengfeng wrote:
> Hi,
>  
> https://github.com/torvalds/linux/blob/master/drivers/char/virtio_console.c#L1657
>  
> Our experimental static analysis tool detects a suspected null-pointer-dereference problem. We manually check it, but It still could be false positive because we are not familiar with the code. We report this to you just in case.
>  
> We notice that in some branches of switch case at line #1582, the pointer port is null check. But null check is missing at line #1657 and line #1633. It seems like a suspected null-pointer dereference pointer. Would you like to spare some time to have a look at it?

For this NULL deref to happen, the host will have to send a port_name
command before a port_add command.  Worrying about that isn't
worthwhile.  If you'd like to add a generic `if (unlikely(!port))`
after line 1579 there, that'd be fine as a hint to the static analysis
tools, though, so just for that reason, it might be worthwhile.

		Amit