linux-kernel - Re: [PATCH] io: adc: stm32-adc: fix potential NULL pointer dereference in stm32_adc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230716170821.3305e3fa@jic23-huawei>
Date:   Sun, 16 Jul 2023 17:08:21 +0100
From:   Jonathan Cameron <jic23@...nel.org>
To:     Zhang Shurong <zhang_shurong@...mail.com>
Cc:     lars@...afoo.de, mcoquelin.stm32@...il.com,
        alexandre.torgue@...s.st.com, lgirdwood@...il.com,
        broonie@...nel.org, linux-iio@...r.kernel.org,
        linux-stm32@...md-mailman.stormreply.com,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] io: adc: stm32-adc: fix potential NULL pointer
 dereference in stm32_adc_probe()

On Sat, 15 Jul 2023 23:55:50 +0800
Zhang Shurong <zhang_shurong@...mail.com> wrote:

> of_match_device() may fail and returns a NULL pointer.
> 
> Fix this by checking the return value of of_match_device().
> 
> Fixes: 64ad7f6438f3 ("iio: adc: stm32: introduce compatible data cfg")
> Signed-off-by: Zhang Shurong <zhang_shurong@...mail.com>
Hi Zhang,

I'm not sure we can actually make this bug happen. Do you have
a way of triggering it?  The driver is only probed on devices where
that match will work.

Also, assuming the match table is the same one associated with this probe
function, then us priv->cfg = of_device_get_match_data() and check the output
of that which is what we really care about.

Jonathan

> ---
>  drivers/iio/adc/stm32-adc-core.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c
> index 48f02dcc81c1..70011fdbf5f6 100644
> --- a/drivers/iio/adc/stm32-adc-core.c
> +++ b/drivers/iio/adc/stm32-adc-core.c
> @@ -706,6 +706,8 @@ static int stm32_adc_probe(struct platform_device *pdev)
>  	struct stm32_adc_priv *priv;
>  	struct device *dev = &pdev->dev;
>  	struct device_node *np = pdev->dev.of_node;
> +	const struct of_device_id *of_id;
> +
>  	struct resource *res;
>  	u32 max_rate;
>  	int ret;
> @@ -718,8 +720,11 @@ static int stm32_adc_probe(struct platform_device *pdev)
>  		return -ENOMEM;
>  	platform_set_drvdata(pdev, &priv->common);
>  
> -	priv->cfg = (const struct stm32_adc_priv_cfg *)
> -		of_match_device(dev->driver->of_match_table, dev)->data;
> +	of_id = of_match_device(dev->driver->of_match_table, dev);
> +	if (!of_id)
> +		return -ENODEV;
> +
> +	priv->cfg = (const struct stm32_adc_priv_cfg *)of_id->data;
>  	priv->nb_adc_max = priv->cfg->num_adcs;
>  	spin_lock_init(&priv->common.lock);
>