From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-176.mta0.migadu.com (out-176.mta0.migadu.com [91.218.175.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F93C79CD for ; Tue, 16 Jul 2024 01:04:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1721091873; cv=none; b=WVqnxFrcyGhgkkgCJfFfj0KquXT3En40SerKq0exPTdckz4o3mzhrtUPT1jfiDr2Y+7g7f9Sm/JvR3mPbYN1zgDtCwNHYtrGrQ2gn1eweevA80NYgtxrbQGPhB2v7JbnyNMQCCJKMIHTgAf6/5pkmXUKibf4TzF9Hv2Z5O6xRIY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1721091873; c=relaxed/simple; bh=DxVL674DykXj38h1XVGpn0hsaGmd4nf0QTNzrbjYn8M=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=KqYV5oG+Xlv0bzp0BqlKh18MIYvfDeLwC5hn8LERBNWXA141YQ7p3DPAsqmIPGWSTQ4uurwVrORL5SavhqqaADc6eYeqIUSmhkTdAoq9CSEsRDIU0nIKlT7iX3nz2P0zu7Wlb8oxN8OuhcvRDzLotfu7iMgXneRb4dPWvmvr/Ww= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=itbrRJox; arc=none smtp.client-ip=91.218.175.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="itbrRJox" X-Envelope-To: jarkko@kernel.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1721091867; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rrsdvOcbnZj3fLM/P3nqd13De7FARkH+xOOXrXATVM0=; b=itbrRJoxtO+pLwhn2iCH2bPN8FYFO9ODrSsOjdtfC8sPOGXa2S0CGR745jKwKFlH46Bf7s 8FPVMAmvHtIeGiKJcN7LS/QuOgmwi5BC1W0/qhlvkFXrNkkQDcq3CJB+TVm9sRuSx0iwN7 P2FkeEmQc5ApsAYkJUkOqhKVS4kEhNY= X-Envelope-To: peterhuewe@gmx.de X-Envelope-To: jgg@ziepe.ca X-Envelope-To: linux-integrity@vger.kernel.org X-Envelope-To: linux-kernel@vger.kernel.org X-Envelope-To: gehao@kylinos.cn Message-ID: <593e3ae7-1f8c-218a-a5ce-3d90e3008999@linux.dev> Date: Tue, 16 Jul 2024 09:04:08 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [PATCH] tpm: Move dereference after NULL check in tpm_buf_check_hmac_response To: Jarkko Sakkinen , peterhuewe@gmx.de, jgg@ziepe.ca Cc: linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, Hao Ge References: <20240709023337.102509-1-hao.ge@linux.dev> X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Hao Ge In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT Hi Jarkko Have a nice day. On 7/15/24 19:25, Jarkko Sakkinen wrote: > On Tue Jul 9, 2024 at 5:33 AM EEST, Hao Ge wrote: >> From: Hao Ge >> >> We shouldn't dereference "auth" until after we have checked that it is >> non-NULL. >> >> Fixes: 7ca110f2679b ("tpm: Address !chip->auth in tpm_buf_append_hmac_session*()") >> Signed-off-by: Hao Ge > Also lacking: > > Reported-by: Dan Carpenter > Closes: https://lore.kernel.org/linux-integrity/3b1755a9-b12f-42fc-b26d-de2fe4e13ec2@stanley.mountain/T/#u Regarding this version, I don't think I should add these. I send this patch on July 9th, 2024. The following email was sent on July 13th, 2024. https://lore.kernel.org/linux-integrity/3b1755a9-b12f-42fc-b26d-de2fe4e13ec2@stanley.mountain/T/#u I think these should be included in the subsequent versions (if any). > > What is happening here is that my commit exposed pre-existing bug to > static analysis but it did not introduce a new regression. I missed > from your patch how did you ended up to your conclusions. > > Please *do not* ignore the sources next time. Either explain how the bug > was found or provide the reporting source. You are essentially taking > credit and also blame from the work that you did not accomplish > yourself, which is both wrong and dishonest. > > BR, Jarkko OK,got it,I'll pay more attention to such details in the future. I would like to clarify that I did not taking credit and dishonest. As stated earlier, the timeline indicates that my patch preceded his email. Before submitting my patch, I conducted a thorough search to ensure that there were no related submissions,  in order to avoid any duplication of effort and wastage of everyone's time. I didn't expect to have wasted everyone's time because of commit message , and I sincerely apologize for that. Thanks BR Hao