linux-kernel - [PATCH] drm/vc4: Fix NULL pointer access in vc4_platform_drm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221120142737.17519-1-LinoSanfilippo@gmx.de>
Date:   Sun, 20 Nov 2022 15:27:37 +0100
From:   Lino Sanfilippo <LinoSanfilippo@....de>
To:     airlied@...il.com, daniel@...ll.ch, eric@...olt.net
Cc:     emma@...olt.net, mripard@...nel.org,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        l.sanfilippo@...bus.com, LinoSanfilippo@....de, lukas@...ner.de,
        p.rosenberger@...bus.com, stable@...r.kernel.org
Subject: [PATCH] drm/vc4: Fix NULL pointer access in vc4_platform_drm_probe()

From: Lino Sanfilippo <l.sanfilippo@...bus.com>

In vc4_platform_drm_probe() function vc4_match_add_drivers() is called to
find component matches for the component drivers. If no such match is found
the passed variable "match" is still NULL after the function returns.

Do not pass "match" to component_master_add_with_match() in this case since
this results in a NULL pointer access as soon as match->num is used to
allocate a component_match array. Instead return with -ENODEV from the
drivers probe function.

Fixes: c8b75bca92cb ("drm/vc4: Add KMS support for Raspberry Pi.")
Cc: stable@...r.kernel.org
Signed-off-by: Lino Sanfilippo <l.sanfilippo@...bus.com>
---
 drivers/gpu/drm/vc4/vc4_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 2027063fdc30..2e53d7f8ad44 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -437,6 +437,9 @@ static int vc4_platform_drm_probe(struct platform_device *pdev)
 	vc4_match_add_drivers(dev, &match,
 			      component_drivers, ARRAY_SIZE(component_drivers));
 
+	if (!match)
+		return -ENODEV;
+
 	return component_master_add_with_match(dev, &vc4_drm_ops, match);
 }
 

base-commit: 30a0b95b1335e12efef89dd78518ed3e4a71a763
-- 
2.36.1