linux-kernel - Re: [PATCH] drivers: video: backlight: Fix NULL Pointer Dereference in backlight_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87ldun6u5o.fsf@intel.com>
Date: Mon, 03 Feb 2025 15:21:23 +0200
From: Jani Nikula <jani.nikula@...ux.intel.com>
To: Haoyu Li <lihaoyu499@...il.com>, Lee Jones <lee@...nel.org>, Daniel
 Thompson <danielt@...nel.org>, Jingoo Han <jingoohan1@...il.com>
Cc: Helge Deller <deller@....de>, Rob Herring <robh@...nel.org>,
 dri-devel@...ts.freedesktop.org, linux-fbdev@...r.kernel.org,
 linux-kernel@...r.kernel.org, chenyuan0y@...il.com,
 zichenxie0106@...il.com, Haoyu Li <lihaoyu499@...il.com>,
 stable@...r.kernel.org
Subject: Re: [PATCH] drivers: video: backlight: Fix NULL Pointer Dereference
 in backlight_device_register()

On Thu, 30 Jan 2025, Haoyu Li <lihaoyu499@...il.com> wrote:
> In the function "wled_probe", the "wled->name" is dynamically allocated
> (wled_probe -> wled_configure -> devm_kasprintf), which is possible
> to be null.
>
> In the call trace: wled_probe -> devm_backlight_device_register
> -> backlight_device_register, this "name" variable is directly
> dereferenced without checking. We add a null-check statement.
>
> Fixes: f86b77583d88 ("backlight: pm8941: Convert to using %pOFn instead of device_node.name")
> Signed-off-by: Haoyu Li <lihaoyu499@...il.com>
> Cc: stable@...r.kernel.org

IMO whoever allocates should be responsible for checking NULL instead of
passing NULL around and expecting everyone check their input for NULL.

BR,
Jani.


> ---
>  drivers/video/backlight/backlight.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
> index f699e5827ccb..b21670bd86de 100644
> --- a/drivers/video/backlight/backlight.c
> +++ b/drivers/video/backlight/backlight.c
> @@ -414,6 +414,8 @@ struct backlight_device *backlight_device_register(const char *name,
>  	struct backlight_device *new_bd;
>  	int rc;
>  
> +	if (!name)
> +		return ERR_PTR(-EINVAL);
>  	pr_debug("backlight_device_register: name=%s\n", name);
>  
>  	new_bd = kzalloc(sizeof(struct backlight_device), GFP_KERNEL);

-- 
Jani Nikula, Intel