[PATCH v6] lib: fix dereferencing of a NULL pointer

[PATCH v6] lib: fix dereferencing of a NULL pointer

[Abdelrahman Youssef via B4 Relay]

From: Abdelrahman Youssef <abdelrahmanyossef12@gmail.com>

Runtime reported by AddressSanitizer due to time a NULL pointer dereference.

This is the stack trace:
    #0 0x5b2550e70c4b in get_param_by_name /barebox/lib/parameter.c:56:2
    #1 0x5b2550e70c4b in __dev_add_param /barebox/lib/parameter.c:153:6
    #2 0x5b2550e71666 in __dev_add_param_int /barebox/lib/parameter.c:471:8
    #3 0x5b2550daece8 in dev_add_param_uint32 /barebox/include/param.h:266:1
    #4 0x5b2550daece8 in dos_partition /barebox/common/partitions/dos.c:289:2
    #5 0x5b2550dadc62 in fuzz_partition_table_parser /barebox/common/partitions.c:331:10
    #6 0x5b2550dadc62 in fuzz_partition_table_parser_ramdisk /barebox/common/partitions.c:344:1
    #7 0x5b2550ebb94d in fuzz_test_once /barebox/include/fuzz.h:68:2
    #8 0x5b2550ebb94d in fuzz_main /barebox/lib/fuzz.c:38:3
    #9 0x5b2550d8eb41 in start_barebox /barebox/common/startup.c:381:3
    #10 0x5b2550f4ea6d in sandbox_main (/barebox/images/main.elf+0x411a6d) (BuildId: dfdb3401891b94e86545eddb1502f0815ffd0afb)
    #11 0x5b2550f4f2b2 in start_barebox_coop fuzz.c

Signed-off-by: Abdelrahman Youssef <abdelrahmanyossef12@gmail.com>
---
 lib/parameter.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/parameter.c b/lib/parameter.c
index bf9e83152b..21fa9e7e70 100644
--- a/lib/parameter.c
+++ b/lib/parameter.c
@@ -51,6 +51,9 @@ const char *get_param_type(struct param_d *param)
 
 struct param_d *get_param_by_name(struct device *dev, const char *name)
 {
+	if (!dev)
+		return NULL;
+
 	struct param_d *p;
 
 	list_for_each_entry(p, &dev->parameters, list) {

---
base-commit: 9d47ff66c3892c5a6ddd4704993365a797fbeb68
change-id: 20241021-null_der-1378213f0da2

Best regards,
-- 
Abdelrahman Youssef <abdelrahmanyossef12@gmail.com>

Re: [PATCH v6] lib: fix dereferencing of a NULL pointer

[Ahmad Fatoum]

Hello,

Why is this v6? Do you need to reset your b4 setup somehow? :-)

Tip: with b4 send --reflect and --dry-run, you can check how the patches
look like before sending them.

On 21.10.24 17:43, Abdelrahman Youssef via B4 Relay wrote:
> From: Abdelrahman Youssef <abdelrahmanyossef12@gmail.com>
> 
> Runtime reported by AddressSanitizer due to time a NULL pointer dereference.
> 
> This is the stack trace:
>     #0 0x5b2550e70c4b in get_param_by_name /barebox/lib/parameter.c:56:2
>     #1 0x5b2550e70c4b in __dev_add_param /barebox/lib/parameter.c:153:6
>     #2 0x5b2550e71666 in __dev_add_param_int /barebox/lib/parameter.c:471:8
>     #3 0x5b2550daece8 in dev_add_param_uint32 /barebox/include/param.h:266:1
>     #4 0x5b2550daece8 in dos_partition /barebox/common/partitions/dos.c:289:2
>     #5 0x5b2550dadc62 in fuzz_partition_table_parser /barebox/common/partitions.c:331:10
>     #6 0x5b2550dadc62 in fuzz_partition_table_parser_ramdisk /barebox/common/partitions.c:344:1
>     #7 0x5b2550ebb94d in fuzz_test_once /barebox/include/fuzz.h:68:2
>     #8 0x5b2550ebb94d in fuzz_main /barebox/lib/fuzz.c:38:3
>     #9 0x5b2550d8eb41 in start_barebox /barebox/common/startup.c:381:3
>     #10 0x5b2550f4ea6d in sandbox_main (/barebox/images/main.elf+0x411a6d) (BuildId: dfdb3401891b94e86545eddb1502f0815ffd0afb)
>     #11 0x5b2550f4f2b2 in start_barebox_coop fuzz.c
> 
> Signed-off-by: Abdelrahman Youssef <abdelrahmanyossef12@gmail.com>
> ---
>  lib/parameter.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/lib/parameter.c b/lib/parameter.c
> index bf9e83152b..21fa9e7e70 100644
> --- a/lib/parameter.c
> +++ b/lib/parameter.c
> @@ -51,6 +51,9 @@ const char *get_param_type(struct param_d *param)
>  
>  struct param_d *get_param_by_name(struct device *dev, const char *name)
>  {
> +	if (!dev)
> +		return NULL;

I don't think that's the correct place to fix this. The pointer shouldn't have been
NULL in the first place. The problem seems with the fuzzing infrastructure not
allocating a device for the ramdisks.

I'll look into a fix and push it to my Github branch.

Cheers,
Ahmad

> +
>  	struct param_d *p;
>  
>  	list_for_each_entry(p, &dev->parameters, list) {
> 
> ---
> base-commit: 9d47ff66c3892c5a6ddd4704993365a797fbeb68
> change-id: 20241021-null_der-1378213f0da2
> 
> Best regards,


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

Re: [PATCH v6] lib: fix dereferencing of a NULL pointer

[Sascha Hauer]

Hi,

When sending a new series you have to start over b4 with

b4 prep -n <topic> -f master

As your old series (which went up to v5) was applied you can delete the
branch.

That said, no need to resend just for this.

Sascha

On Mon, Oct 21, 2024 at 06:43:03PM +0300, Abdelrahman Youssef via B4 Relay wrote:
> From: Abdelrahman Youssef <abdelrahmanyossef12@gmail.com>
> 
> Runtime reported by AddressSanitizer due to time a NULL pointer dereference.
> 
> This is the stack trace:
>     #0 0x5b2550e70c4b in get_param_by_name /barebox/lib/parameter.c:56:2
>     #1 0x5b2550e70c4b in __dev_add_param /barebox/lib/parameter.c:153:6
>     #2 0x5b2550e71666 in __dev_add_param_int /barebox/lib/parameter.c:471:8
>     #3 0x5b2550daece8 in dev_add_param_uint32 /barebox/include/param.h:266:1
>     #4 0x5b2550daece8 in dos_partition /barebox/common/partitions/dos.c:289:2
>     #5 0x5b2550dadc62 in fuzz_partition_table_parser /barebox/common/partitions.c:331:10
>     #6 0x5b2550dadc62 in fuzz_partition_table_parser_ramdisk /barebox/common/partitions.c:344:1
>     #7 0x5b2550ebb94d in fuzz_test_once /barebox/include/fuzz.h:68:2
>     #8 0x5b2550ebb94d in fuzz_main /barebox/lib/fuzz.c:38:3
>     #9 0x5b2550d8eb41 in start_barebox /barebox/common/startup.c:381:3
>     #10 0x5b2550f4ea6d in sandbox_main (/barebox/images/main.elf+0x411a6d) (BuildId: dfdb3401891b94e86545eddb1502f0815ffd0afb)
>     #11 0x5b2550f4f2b2 in start_barebox_coop fuzz.c
> 
> Signed-off-by: Abdelrahman Youssef <abdelrahmanyossef12@gmail.com>
> ---
>  lib/parameter.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/lib/parameter.c b/lib/parameter.c
> index bf9e83152b..21fa9e7e70 100644
> --- a/lib/parameter.c
> +++ b/lib/parameter.c
> @@ -51,6 +51,9 @@ const char *get_param_type(struct param_d *param)
>  
>  struct param_d *get_param_by_name(struct device *dev, const char *name)
>  {
> +	if (!dev)
> +		return NULL;
> +
>  	struct param_d *p;
>  
>  	list_for_each_entry(p, &dev->parameters, list) {
> 
> ---
> base-commit: 9d47ff66c3892c5a6ddd4704993365a797fbeb68
> change-id: 20241021-null_der-1378213f0da2
> 
> Best regards,
> -- 
> Abdelrahman Youssef <abdelrahmanyossef12@gmail.com>
> 
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |