linux-kernel - Re: [PATCH] tty: timbuart: Check for null res pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <13b27c0f-f3a5-1176-7d80-5a6d0ce52925@kernel.org>
Date:   Mon, 20 Dec 2021 14:29:38 +0100
From:   Jiri Slaby <jirislaby@...nel.org>
To:     Jiasheng Jiang <jiasheng@...as.ac.cn>, gregkh@...uxfoundation.org
Cc:     linux-serial@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] tty: timbuart: Check for null res pointer

On 20. 12. 21, 9:21, Jiasheng Jiang wrote:
> The return value of platform_get_resource() needs to be checked.
> To avoid use of error pointer in case that there is no suitable
> resource.
> 
> Fixes: ab4382d27412 ("tty: move drivers/serial/ to drivers/tty/serial/")

Barely.

> Signed-off-by: Jiasheng Jiang <jiasheng@...as.ac.cn>
> ---
>   drivers/tty/serial/timbuart.c | 9 +++++++--
>   1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/serial/timbuart.c b/drivers/tty/serial/timbuart.c
> index 08941eabe7b1..262154d2f40f 100644
> --- a/drivers/tty/serial/timbuart.c
> +++ b/drivers/tty/serial/timbuart.c
> @@ -312,9 +312,14 @@ static const char *timbuart_type(struct uart_port *port)
>    */
>   static void timbuart_release_port(struct uart_port *port)
>   {
> +	struct resource *res;
> +	int size;
>   	struct platform_device *pdev = to_platform_device(port->dev);
> -	int size =
> -		resource_size(platform_get_resource(pdev, IORESOURCE_MEM, 0));
> +	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> +	if (!res)
> +		size = 0;

How can this happen and what happens when you pass zero size to 
release_mem_region?

> +	else
> +		size = resource_size(res);
>   
>   	if (port->flags & UPF_IOREMAP) {
>   		iounmap(port->membase);


-- 
js
suse labs