linux-kernel - [PATCH] pwdomain: Fix ERR_PTR() dereference in core.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20241112202422.17113-1-surajsonawane0215@gmail.com>
Date: Wed, 13 Nov 2024 01:54:22 +0530
From: Suraj Sonawane <surajsonawane0215@...il.com>
To: Ulf Hansson <ulf.hansson@...aro.org>
Cc: linux-pm@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Suraj Sonawane <surajsonawane0215@...il.com>
Subject: [PATCH] pwdomain: Fix ERR_PTR() dereference in core.c

Fix an issue detected by the Smatch tool:

drivers/pmdomain/core.c:509 genpd_dev_pm_set_performance_state() error:
'genpd' dereferencing possible ERR_PTR()
drivers/pmdomain/core.c:970 genpd_dev_pm_start() error:
'genpd' dereferencing possible ERR_PTR()

The function `dev_to_genpd(dev)` may return an error pointer, and
the code does not check whether it is valid before dereferencing.
This can lead to undefined behavior. To fix this, checks were added
to ensure that `genpd` is not an error pointer before using it.
If an error pointer is encountered, the function returns the error
value using `PTR_ERR(genpd)`.

Signed-off-by: Suraj Sonawane <surajsonawane0215@...il.com>
---
 drivers/pmdomain/core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/pmdomain/core.c b/drivers/pmdomain/core.c
index 5ede0f7ed..69dc8471e 100644
--- a/drivers/pmdomain/core.c
+++ b/drivers/pmdomain/core.c
@@ -506,6 +506,9 @@ static int genpd_dev_pm_set_performance_state(struct device *dev,
 	struct generic_pm_domain *genpd = dev_to_genpd(dev);
 	int ret = 0;
 
+	if (IS_ERR(genpd))
+		return PTR_ERR(genpd);
+
 	genpd_lock(genpd);
 	if (pm_runtime_suspended(dev)) {
 		dev_gpd_data(dev)->rpm_pstate = state;
@@ -963,6 +966,9 @@ static int genpd_dev_pm_start(struct device *dev)
 {
 	struct generic_pm_domain *genpd = dev_to_genpd(dev);
 
+	if (IS_ERR(genpd))
+		return PTR_ERR(genpd);
+
 	return genpd_start_dev(genpd, dev);
 }
 
-- 
2.34.1