linux-kernel - [PATCH] libnvdimm: fix NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 Jul 2018 08:40:06 -0500
From:   "Gustavo A. R. Silva" <gustavo@...eddedor.com>
To:     Keith Busch <keith.busch@...el.com>,
        Dan Williams <dan.j.williams@...el.com>,
        Ross Zwisler <zwisler@...nel.org>,
        Vishal Verma <vishal.l.verma@...el.com>,
        Dave Jiang <dave.jiang@...el.com>
Cc:     linux-nvdimm@...ts.01.org, linux-kernel@...r.kernel.org,
        "Gustavo A. R. Silva" <gustavo@...eddedor.com>
Subject: [PATCH] libnvdimm: fix NULL pointer dereference

ndd is being dereferenced before it is null checked, hence there is a
potential null pointer dereference.

Fix this by moving the pointer dereference after ndd has been properly
null checked at line 554: if (!ndd)

Addresses-Coverity-ID: 1472020 ("Dereference before null check")
Fixes: 42218e643bd2 ("libnvdimm: Use max contiguous area for namespace size")
Signed-off-by: Gustavo A. R. Silva <gustavo@...eddedor.com>
---
 drivers/nvdimm/dimm_devs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index 9e977cb..1dc3125 100644
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -546,7 +546,7 @@ resource_size_t nd_pmem_max_contiguous_dpa(struct nd_region *nd_region,
 					   struct nd_mapping *nd_mapping)
 {
 	struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
-	struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(ndd->dev);
+	struct nvdimm_bus *nvdimm_bus;
 	resource_size_t max = 0;
 	struct resource *res;
 
@@ -554,6 +554,8 @@ resource_size_t nd_pmem_max_contiguous_dpa(struct nd_region *nd_region,
 	if (!ndd)
 		return 0;
 
+	nvdimm_bus = walk_to_nvdimm_bus(ndd->dev);
+
 	if (reserve_free_pmem(nvdimm_bus, nd_mapping))
 		return 0;
 	for_each_dpa_resource(ndd, res) {
-- 
2.7.4