linux-kernel - Re: [PATCH v3 RESEND] pps: add an error check in parport

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <78128328-7006-419e-9977-1487b3a2dab0@enneenne.com>
Date: Mon, 2 Sep 2024 09:15:48 +0200
From: Rodolfo Giometti <giometti@...eenne.com>
To: Ma Ke <make24@...as.ac.cn>, christophe.jaillet@...adoo.fr,
 linux@...blig.org, akpm@...ux-foundation.org, sudipm.mukherjee@...il.com,
 gregkh@...uxfoundation.org
Cc: linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v3 RESEND] pps: add an error check in parport_attach

On 28/08/24 15:18, Ma Ke wrote:
> In parport_attach, the return value of ida_alloc is unchecked, witch leads
> to the use of an invalid index value.
> 
> To address this issue, index should be checked. When the index value is
> abnormal, the device should be freed.
> 
> Found by code review, compile tested only.
> 
> Cc: stable@...r.kernel.org
> Fixes: fb56d97df70e ("pps: client: use new parport device model")
> Signed-off-by: Ma Ke <make24@...as.ac.cn>

Acked-by: Rodolfo Giometti <giometti@...eenne.com>

> ---
> Changes in v3:
> - modified Fixes tag as suggestions.
> Changes in v2:
> - removed error output as suggestions.
> ---
>   drivers/pps/clients/pps_parport.c | 8 ++++++--
>   1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/pps/clients/pps_parport.c b/drivers/pps/clients/pps_parport.c
> index 63d03a0df5cc..abaffb4e1c1c 100644
> --- a/drivers/pps/clients/pps_parport.c
> +++ b/drivers/pps/clients/pps_parport.c
> @@ -149,6 +149,9 @@ static void parport_attach(struct parport *port)
>   	}
>   
>   	index = ida_alloc(&pps_client_index, GFP_KERNEL);
> +	if (index < 0)
> +		goto err_free_device;
> +
>   	memset(&pps_client_cb, 0, sizeof(pps_client_cb));
>   	pps_client_cb.private = device;
>   	pps_client_cb.irq_func = parport_irq;
> @@ -159,7 +162,7 @@ static void parport_attach(struct parport *port)
>   						    index);
>   	if (!device->pardev) {
>   		pr_err("couldn't register with %s\n", port->name);
> -		goto err_free;
> +		goto err_free_ida;
>   	}
>   
>   	if (parport_claim_or_block(device->pardev) < 0) {
> @@ -187,8 +190,9 @@ static void parport_attach(struct parport *port)
>   	parport_release(device->pardev);
>   err_unregister_dev:
>   	parport_unregister_device(device->pardev);
> -err_free:
> +err_free_ida:
>   	ida_free(&pps_client_index, index);
> +err_free_device:
>   	kfree(device);
>   }
>   

-- 
GNU/Linux Solutions                  e-mail: giometti@...eenne.com
Linux Device Driver                          giometti@...ux.it
Embedded Systems                     phone:  +39 349 2432127
UNIX programming