linux-kernel - [PATCH] staging: vc04_services: vchiq_arm: fix error return code of vchiq_release_internal() and vchiq_use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20210306132245.16811-1-baijiaju1990@gmail.com>
Date:   Sat,  6 Mar 2021 05:22:45 -0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     nsaenzjulienne@...e.de, gregkh@...uxfoundation.org, arnd@...db.de,
        dan.carpenter@...cle.com, phil@...pberrypi.com,
        amarjargal16@...il.com
Cc:     bcm-kernel-feedback-list@...adcom.com,
        linux-rpi-kernel@...ts.infradead.org,
        linux-arm-kernel@...ts.infradead.org, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org, Jia-Ju Bai <baijiaju1990@...il.com>
Subject: [PATCH] staging: vc04_services: vchiq_arm: fix error return code of vchiq_release_internal() and vchiq_use_internal()

When arm_state is NULL, no error return code of vchiq_release_internal()
and vchiq_use_internal() is assigned.
To fix this bug, ret is assigned with VCHIQ_ERROR.

Reported-by: TOTE Robot <oslab@...nghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@...il.com>
---
 .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 59e45dc03a97..8b2b4771f420 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -2332,8 +2332,10 @@ vchiq_use_internal(struct vchiq_state *state, struct vchiq_service *service,
 	int *entity_uc;
 	int local_uc;
 
-	if (!arm_state)
+	if (!arm_state) {
+		ret = VCHIQ_ERROR;
 		goto out;
+	}
 
 	vchiq_log_trace(vchiq_susp_log_level, "%s", __func__);
 
@@ -2389,8 +2391,10 @@ vchiq_release_internal(struct vchiq_state *state, struct vchiq_service *service)
 	char entity[16];
 	int *entity_uc;
 
-	if (!arm_state)
+	if (!arm_state) {
+		ret = VCHIQ_ERROR;
 		goto out;
+	}
 
 	vchiq_log_trace(vchiq_susp_log_level, "%s", __func__);
 
-- 
2.17.1