linux-kernel - [PATCH] PM / devfreq: Strengthen the handling of governor null pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20220701045315.61456-1-schspa@gmail.com>
Date:   Fri,  1 Jul 2022 12:53:15 +0800
From:   Schspa Shi <schspa@...il.com>
To:     myungjoo.ham@...sung.com, kyungmin.park@...sung.com,
        cw00.choi@...sung.com
Cc:     linux-pm@...r.kernel.org, linux-kernel@...r.kernel.org,
        Schspa Shi <schspa@...il.com>
Subject: [PATCH] PM / devfreq: Strengthen the handling of governor null pointer

When new governor start failed & the old governor start failed too,
or the governor is removed, the devfreq->governor will be NULL, but
we still access it's member from devfreq->governor->name, which will
be a crash.

To fix it, change the position of Null pointer judgment before usage.

Another, If the governor is NULL, we try to assign a new governor to
it.

Signed-off-by: Schspa Shi <schspa@...il.com>
---
 drivers/devfreq/devfreq.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
index 01474daf4548..30d7f8c128a6 100644
--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -1270,7 +1270,13 @@ int devfreq_add_governor(struct devfreq_governor *governor)
 		int ret = 0;
 		struct device *dev = devfreq->dev.parent;
 
-		if (!strncmp(devfreq->governor->name, governor->name,
+		/*
+		 * When new governor start failed & the old governor start
+		 * failed too. devfreq->governor will be NULL.
+		 * Try to assign the new governor to this devfreq device.
+		 */
+		if (!devfreq->governor ||
+			!strncmp(devfreq->governor->name, governor->name,
 			     DEVFREQ_NAME_LEN)) {
 			/* The following should never occur */
 			if (devfreq->governor) {
@@ -1358,15 +1364,15 @@ int devfreq_remove_governor(struct devfreq_governor *governor)
 		int ret;
 		struct device *dev = devfreq->dev.parent;
 
+		/* we should have a devfreq governor! */
+		if (!devfreq->governor) {
+			dev_warn(dev, "%s: Governor %s NOT present\n",
+				__func__, governor->name);
+			continue;
+		}
+
 		if (!strncmp(devfreq->governor->name, governor->name,
 			     DEVFREQ_NAME_LEN)) {
-			/* we should have a devfreq governor! */
-			if (!devfreq->governor) {
-				dev_warn(dev, "%s: Governor %s NOT present\n",
-					 __func__, governor->name);
-				continue;
-				/* Fall through */
-			}
 			ret = devfreq->governor->event_handler(devfreq,
 						DEVFREQ_GOV_STOP, NULL);
 			if (ret) {
-- 
2.29.0