linux-kernel - [PATCH] drivers: video: backlight: Fix NULL Pointer Dereference in backlight_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250130145228.96679-1-lihaoyu499@gmail.com>
Date: Thu, 30 Jan 2025 22:52:28 +0800
From: Haoyu Li <lihaoyu499@...il.com>
To: Lee Jones <lee@...nel.org>,
	Daniel Thompson <danielt@...nel.org>,
	Jingoo Han <jingoohan1@...il.com>
Cc: Helge Deller <deller@....de>,
	Rob Herring <robh@...nel.org>,
	dri-devel@...ts.freedesktop.org,
	linux-fbdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	chenyuan0y@...il.com,
	zichenxie0106@...il.com,
	Haoyu Li <lihaoyu499@...il.com>,
	stable@...r.kernel.org
Subject: [PATCH] drivers: video: backlight: Fix NULL Pointer Dereference in backlight_device_register()

In the function "wled_probe", the "wled->name" is dynamically allocated
(wled_probe -> wled_configure -> devm_kasprintf), which is possible
to be null.

In the call trace: wled_probe -> devm_backlight_device_register
-> backlight_device_register, this "name" variable is directly
dereferenced without checking. We add a null-check statement.

Fixes: f86b77583d88 ("backlight: pm8941: Convert to using %pOFn instead of device_node.name")
Signed-off-by: Haoyu Li <lihaoyu499@...il.com>
Cc: stable@...r.kernel.org
---
 drivers/video/backlight/backlight.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index f699e5827ccb..b21670bd86de 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -414,6 +414,8 @@ struct backlight_device *backlight_device_register(const char *name,
 	struct backlight_device *new_bd;
 	int rc;
 
+	if (!name)
+		return ERR_PTR(-EINVAL);
 	pr_debug("backlight_device_register: name=%s\n", name);
 
 	new_bd = kzalloc(sizeof(struct backlight_device), GFP_KERNEL);
-- 
2.34.1