linux-kernel - [PATCH] perf/x86/uncore: avoid null-ptr-deref on error in pmu_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun,  4 Feb 2024 16:48:41 +0300
From: Fedor Pchelkin <pchelkin@...ras.ru>
To: Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...hat.com>
Cc: Fedor Pchelkin <pchelkin@...ras.ru>,
	Arnaldo Carvalho de Melo <acme@...nel.org>,
	x86@...nel.org,
	Alexander Antonov <alexander.antonov@...ux.intel.com>,
	Kan Liang <kan.liang@...ux.intel.com>,
	linux-perf-users@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org
Subject: [PATCH] perf/x86/uncore: avoid null-ptr-deref on error in pmu_alloc_topology

If topology[die] array allocation fails then topology[die][idx] elements
can't be accessed on error path.

Checking this on the error path probably looks more readable than
decrementing the counter in the allocation loop.

Found by Linux Verification Center (linuxtesting.org).

Fixes: 4d13be8ab5d4 ("perf/x86/intel/uncore: Generalize IIO topology support")
Signed-off-by: Fedor Pchelkin <pchelkin@...ras.ru>
---
 arch/x86/events/intel/uncore_snbep.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index a96496bef678..7d4deb9126be 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3831,9 +3831,11 @@ static int pmu_alloc_topology(struct intel_uncore_type *type, int topology_type)
 	return 0;
 clear:
 	for (; die >= 0; die--) {
-		for (idx = 0; idx < type->num_boxes; idx++)
-			kfree(topology[die][idx].untyped);
-		kfree(topology[die]);
+		if (topology[die]) {
+			for (idx = 0; idx < type->num_boxes; idx++)
+				kfree(topology[die][idx].untyped);
+			kfree(topology[die]);
+		}
 	}
 	kfree(topology);
 err:
-- 
2.39.2