linux-kernel - [PATCH] drivers: core: prevent dereferencing of a null pointer in device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 7 Mar 2024 16:11:41 +0300
From: Roman Smirnov <r.smirnov@....ru>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, "Rafael J. Wysocki"
	<rafael@...nel.org>
CC: Roman Smirnov <r.smirnov@....ru>, Sergey Shtylyov <s.shtylyov@....ru>,
	Karina Yankevich <k.yankevich@....ru>, <linux-kernel@...r.kernel.org>,
	<lvc-project@...uxtesting.org>
Subject: [PATCH] drivers: core: prevent dereferencing of a null pointer in device_move()

Parameter new_parent can be equal to NULL. In this case if the 
drm_order parameter is equal to DRM_ORDER_DEV_AFTER_PARENT or
DRM_ORDER_PARENT_BEFORE_DEV, a null pointer will be dereferenced.

Found by Linux Verification Center (linuxtesting.org) with Svace.

Signed-off-by: Roman Smirnov <r.smirnov@....ru>
Reviewed-by: Sergey Shtylyov <s.shtylyov@....ru>
---
 drivers/base/core.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 9828da9b933c..9af7ccf56f42 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -4593,10 +4593,18 @@ int device_move(struct device *dev, struct device *new_parent,
 	case DPM_ORDER_NONE:
 		break;
 	case DPM_ORDER_DEV_AFTER_PARENT:
+		if (!new_parent) {
+			error = -EINVAL;
+			goto out;
+		}
 		device_pm_move_after(dev, new_parent);
 		devices_kset_move_after(dev, new_parent);
 		break;
 	case DPM_ORDER_PARENT_BEFORE_DEV:
+		if (!new_parent) {
+			error = -EINVAL;
+			goto out;
+		}
 		device_pm_move_before(new_parent, dev);
 		devices_kset_move_before(new_parent, dev);
 		break;
-- 
2.34.1