linux-kernel - [PATCH] drivers: video: backlight: Fix NULL Pointer Dereference in backlight_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20250219122950.7416-1-lihaoyu499@gmail.com>
Date: Wed, 19 Feb 2025 20:29:50 +0800
From: Haoyu Li <lihaoyu499@...il.com>
To: danielt@...nel.org
Cc: chenyuan0y@...il.com,
	deller@....de,
	dri-devel@...ts.freedesktop.org,
	jani.nikula@...ux.intel.com,
	jingoohan1@...il.com,
	lee@...nel.org,
	lihaoyu499@...il.com,
	linux-fbdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	robh@...nel.org,
	stable@...r.kernel.org,
	zichenxie0106@...il.com
Subject: [PATCH] drivers: video: backlight: Fix NULL Pointer Dereference in backlight_device_register()

As per Jani and Daniel's feedback, I have updated the patch so that
the `wled->name` null check now occurs in the `wled_configure`
function, right after the `devm_kasprintf` callsite. This should
resolve the issue.
The updated patch is as follows:

In the function "wled_probe", the "wled->name" is dynamically allocated
(wled_probe -> wled_configure -> devm_kasprintf), and it is possible
for it to be NULL.

To avoid dereferencing a NULL pointer (wled_probe ->
devm_backlight_device_register -> backlight_device_register),
we add a null-check after the allocation rather than in
backlight_device_register.

Fixes: f86b77583d88 ("backlight: pm8941: Convert to using %pOFn instead of device_node.name")
Signed-off-by: Haoyu Li <lihaoyu499@...il.com>
Cc: stable@...r.kernel.org
---
 drivers/video/backlight/qcom-wled.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index 9afe701b2a1b..3dacfef821ca 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -1409,6 +1409,11 @@ static int wled_configure(struct wled *wled)
 	if (rc)
 		wled->name = devm_kasprintf(dev, GFP_KERNEL, "%pOFn", dev->of_node);

+	if (!wled->name) {
+		dev_err(wled->dev, "Fail to initialize wled name\n");
+		return -EINVAL;
+	}
+
 	switch (wled->version) {
 	case 3:
 		u32_opts = wled3_opts;
-- 
2.34.1