linux-kernel - [PATCH] AHCI: fix Null pointer dereference in achi_host

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1374041439-34122-1-git-send-email-xtfeng@gmail.com>
Date:	Wed, 17 Jul 2013 14:10:39 +0800
From:	Xiaotian Feng <xtfeng@...il.com>
To:	unlisted-recipients:; (no To-header on input)
Cc:	Xiaotian Feng <xtfeng@...il.com>,
	Alexander Gordeev <agordeev@...hat.com>,
	Tejun Heo <tj@...nel.org>, linux-ide@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] AHCI: fix Null pointer dereference in achi_host_active()

commit b29900e6 (AHCI: Make distinct names for ports in /proc/interrupts)
introuded a regression, which resulted Null pointer dereference for achi
host with dummy ports. For ahci ports, when the port is dummy port, its
private_data will be NULL, as ata_dummy_port_ops doesn't support ->port_start.

Reported-and-tested-by: Alex Williamson <alex.williamson@...hat.com>
Signed-off-by: Xiaotian Feng <xtfeng@...il.com>
Cc: Alexander Gordeev <agordeev@...hat.com>
Cc: Tejun Heo <tj@...nel.org>
Cc: linux-ide@...r.kernel.org
Cc: linux-kernel@...r.kernel.org
---
 drivers/ata/ahci.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 5064f3e..f1de689 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1147,10 +1147,16 @@ int ahci_host_activate(struct ata_host *host, int irq, unsigned int n_msis)
 
 	for (i = 0; i < host->n_ports; i++) {
 		struct ahci_port_priv *pp = host->ports[i]->private_data;
+		const char *desc;
 
+		if (ata_port_is_dummy(host->ports[i]))
+			desc = dev_driver_string(host->dev);
+		else
+			desc = pp->irq_desc;
+ 
 		rc = devm_request_threaded_irq(host->dev,
 			irq + i, ahci_hw_interrupt, ahci_thread_fn, IRQF_SHARED,
-			pp->irq_desc, host->ports[i]);
+			desc, host->ports[i]);
 		if (rc)
 			goto out_free_irqs;
 	}
-- 
1.7.9.6 (Apple Git-31.1)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/