linux-kernel - Re: [PATCH] PCI: of_property: handle int

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 2 May 2024 17:18:38 -0500
From: Bjorn Helgaas <helgaas@...nel.org>
To: Duoming Zhou <duoming@....edu.cn>
Cc: linux-pci@...r.kernel.org, linux-kernel@...r.kernel.org,
	bhelgaas@...gle.com, Lizhi Hou <lizhi.hou@....com>,
	Rob Herring <robh@...nel.org>
Subject: Re: [PATCH] PCI: of_property: handle int_map allocation failure

[+cc Lizhi (when you post a fix to a commit, please always cc the
author of that original commit), Rob]

On Sun, Mar 03, 2024 at 06:57:29PM +0800, Duoming Zhou wrote:
> The kcalloc() in of_pci_prop_intr_map() will return null if
> the physical memory has run out. As a result, both int_map
> and mapp will point to the null area. If we dereference mapp,
> the null pointer dereference bugs will happen.
> 
> Return -ENOMEM from of_pci_prop_intr_map() if kcalloc() fails
> for int_map.
> 
> Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
> Signed-off-by: Duoming Zhou <duoming@....edu.cn>

Applied to pci/of for v6.10, thanks!

Lizhi and Rob, let me know if you have any objections.

> ---
>  drivers/pci/of_property.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c
> index c2c7334152b..03539e50537 100644
> --- a/drivers/pci/of_property.c
> +++ b/drivers/pci/of_property.c
> @@ -238,6 +238,8 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev, struct of_changeset *ocs,
>  		return 0;
>  
>  	int_map = kcalloc(map_sz, sizeof(u32), GFP_KERNEL);
> +	if (!int_map)
> +		return -ENOMEM;
>  	mapp = int_map;
>  
>  	list_for_each_entry(child, &pdev->subordinate->devices, bus_list) {
> -- 
> 2.17.1
>