linux-kernel - [PATCH] driver: core: Prevent NULL pointer dereference in device name functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230212220441.258258-1-alexander.sverdlin@gmail.com>
Date:   Sun, 12 Feb 2023 23:04:41 +0100
From:   Alexander Sverdlin <alexander.sverdlin@...il.com>
To:     linux-kernel@...r.kernel.org
Cc:     Alexander Sverdlin <alexander.sverdlin@...il.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>
Subject: [PATCH] driver: core: Prevent NULL pointer dereference in device name functions

Prevent similar scenarios:

Unable to handle kernel NULL pointer dereference at virtual address 00000038
...
PC is at dev_driver_string+0x0/0x38

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@...il.com>
---
 drivers/base/core.c    | 3 +++
 include/linux/device.h | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index a3e14143ec0c..4ff2ddea7c9b 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2174,6 +2174,9 @@ const char *dev_driver_string(const struct device *dev)
 {
 	struct device_driver *drv;
 
+	if (!dev)
+		return "<null>";
+
 	/* dev->driver can change to NULL underneath us because of unbinding,
 	 * so be careful about accessing it.  dev->bus and dev->class should
 	 * never change once they are set, so they don't need special care.
diff --git a/include/linux/device.h b/include/linux/device.h
index 44e3acae7b36..ff9e19e6d78c 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -696,6 +696,9 @@ static inline bool device_iommu_mapped(struct device *dev)
 
 static inline const char *dev_name(const struct device *dev)
 {
+	if (!dev)
+		return "<null>";
+
 	/* Use the init name until the kobject becomes available */
 	if (dev->init_name)
 		return dev->init_name;
@@ -712,6 +715,8 @@ static inline const char *dev_name(const struct device *dev)
  */
 static inline const char *dev_bus_name(const struct device *dev)
 {
+	if (!dev)
+		return "<null>";
 	return dev->bus ? dev->bus->name : (dev->class ? dev->class->name : "");
 }
 
-- 
2.39.1