linux-kernel - [PATCH] platform/x86: wmi: fix potential null pointer dereferences

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190122200302.19861-1-2pi@mok.nu>
Date:   Tue, 22 Jan 2019 21:03:01 +0100
From:   Mattias Jacobsson <2pi@....nu>
To:     <dvhart@...radead.org>, <andy@...radead.org>
CC:     <2pi@....nu>, <platform-driver-x86@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>
Subject: [PATCH] platform/x86: wmi: fix potential null pointer dereferences

In the function wmi_dev_match() there are three variables that
potentially can result in a null pointer dereference. Namely:
dev/wblock, driver/wmi_driver, and wmi_driver->id_table.

Check for NULL and return that the driver can't handle the device if any
of these variables would result in a null pointer dereference.

The NULL checks are performed prior to running container_of() for the
variables dev/wblock and driver/wmi_driver.

Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
Signed-off-by: Mattias Jacobsson <2pi@....nu>
---
 drivers/platform/x86/wmi.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index bea35be68706..c596479e8b13 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -763,10 +763,18 @@ static void wmi_dev_release(struct device *dev)
 
 static int wmi_dev_match(struct device *dev, struct device_driver *driver)
 {
-	struct wmi_driver *wmi_driver =
-		container_of(driver, struct wmi_driver, driver);
-	struct wmi_block *wblock = dev_to_wblock(dev);
-	const struct wmi_device_id *id = wmi_driver->id_table;
+	const struct wmi_device_id *id;
+	struct wmi_block *wblock;
+	struct wmi_driver *wmi_driver;
+
+	if (dev == NULL || driver == NULL)
+		return 0;
+	wblock = dev_to_wblock(dev);
+	wmi_driver = container_of(driver, struct wmi_driver, driver);
+
+	if (wmi_driver->id_table == NULL)
+		return 0;
+	id = wmi_driver->id_table;
 
 	while (id->guid_string) {
 		uuid_le driver_guid;
-- 
2.20.1