linux-kernel - [PATCH][next] regmap-irq: Fix dereference of a potentially null d->virt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210406164002.430221-1-colin.king@canonical.com>
Date:   Tue,  6 Apr 2021 17:40:02 +0100
From:   Colin King <colin.king@...onical.com>
To:     Mark Brown <broonie@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J . Wysocki" <rafael@...nel.org>,
        Guru Das Srinagesh <gurus@...eaurora.org>
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH][next] regmap-irq: Fix dereference of a potentially null d->virt_buf

From: Colin Ian King <colin.king@...onical.com>

The clean up of struct d can potentiallly index into a null array
d->virt_buf causing errorenous pointer dereferencing issues on
kfree calls.  Fix this by adding a null check on d->virt_buf before
attempting to traverse the array to kfree the objects.

Addresses-Coverity: ("Dereference after null check")
Fixes: 4c5014456305 ("regmap-irq: Introduce virtual regs to handle more config regs")
Signed-off-by: Colin Ian King <colin.king@...onical.com>
---
 drivers/base/regmap/regmap-irq.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index e6343ccc6aa1..760296a4b606 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -901,9 +901,11 @@ int regmap_add_irq_chip_fwnode(struct fwnode_handle *fwnode,
 	kfree(d->mask_buf);
 	kfree(d->status_buf);
 	kfree(d->status_reg_buf);
-	for (i = 0; i < chip->num_virt_regs; i++)
-		kfree(d->virt_buf[i]);
-	kfree(d->virt_buf);
+	if (d->virt_buf) {
+		for (i = 0; i < chip->num_virt_regs; i++)
+			kfree(d->virt_buf[i]);
+		kfree(d->virt_buf);
+	}
 	kfree(d);
 	return ret;
 }
-- 
2.30.2