Repository navigation
Uninitialized next pointer for pci device may crash kernel #25
Description
When a pci device structure is added to the new linked list implementation its next pointer may be uninitialized. It should be set to NULL.
A new struct pci_device is initialized from a passed in variable pci_dev:
Line 99 in d1a53ab
However, that structure is allocated on the stack in scan_bus so some members may be uninitialized:
Lines 112 to 117 in d1a53ab
If pci_dev has a non-NULL next pointer, the kernel may attempt to access that memory which may be invalid and may crash the kernel.
Whether the crash is reproducible depends on the contents of stack memory which depends on many factors, so I have no easy way of providing a test case that triggers the problem. It always crashes for me and setting next to NULL fixes it.
Activity
mikaku commentedon Feb 24, 2023
Good point.
I think that this line:
Fiwix/drivers/pci/pci.c
Line 91 in d1a53ab
is useless because
pdtis clobbered by the contents ofpci_devsome lines below.I think that instead of setting
pdt->next = NULL;we could remove the line91and put a similar line inside thescan_bus()loop. So, we make sure thatpci_devis properly initialized from the beginning.What do you think?
mikaku commentedon Feb 24, 2023
BTW, It's amazing how you are viewing this code at the same time I was. Today I've been precisely touching these PCI functions. 😃
rick-masters commentedon Feb 24, 2023
Yes, initializing
pci_devsounds like a better solution.mikaku commentedon Feb 24, 2023
I think there are still other bugs because
pci_get_device()enters in an infinite loop when it doesn't found the vendor and device ids.rick-masters commentedon Feb 24, 2023
Hmm, looks to me like it should exit the while loop when it reaches the end of the list.
mikaku commentedon Feb 25, 2023
Thank you.
removed unneeded lines in add_pci_device() #25
initialize pci structure before add it into the linked list fixes mik…