linux-kernel - Re: [PATCH] rtc: gamecube: Check the return value of ioremap()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aSatO6MgjdnurVBJ@desktop>
Date: Wed, 26 Nov 2025 08:33:15 +0100
From: Link Mauve <kernel@...kmauve.fr>
To: Haotian Zhang <vulab@...as.ac.cn>
Cc: alexandre.belloni@...tlin.com, linkmauve@...kmauve.fr,
	linux-rtc@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] rtc: gamecube: Check the return value of ioremap()

Good catch!

On Wed, Nov 26, 2025 at 09:20:19AM +0800, Haotian Zhang wrote:
> The function ioremap() in gamecube_rtc_read_offset_from_sram() can fail
> and return NULL, which is dereferenced without checking, leading to a
> NULL pointer dereference.
> 
> Add a check for the return value of ioremap() and return -ENOMEM on
> failure.
> 
> Fixes: 86559400b3ef ("rtc: gamecube: Add a RTC driver for the GameCube, Wii and Wii U")
> Signed-off-by: Haotian Zhang <vulab@...as.ac.cn>
> ---
>  drivers/rtc/rtc-gamecube.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/rtc/rtc-gamecube.c b/drivers/rtc/rtc-gamecube.c
> index c828bc8e05b9..cd7714437107 100644
> --- a/drivers/rtc/rtc-gamecube.c
> +++ b/drivers/rtc/rtc-gamecube.c
> @@ -242,6 +242,10 @@ static int gamecube_rtc_read_offset_from_sram(struct priv *d)
>  	}
>  
>  	hw_srnprot = ioremap(res.start, resource_size(&res));
> +	if (!hw_srnprot) {
> +		pr_err("Failed to ioremap hw_srnprot\n");

The error messages on lines 240 and 276 start with a lowercase letter,
please use the same case for this message.  From a quick grep through
the kernel, it seems we use either lowercase or uppercase, but I’d
prefer to keep the case consistent in this driver at least.

> +		return -ENOMEM;
> +	}
>  	old = ioread32be(hw_srnprot);
>  
>  	/* TODO: figure out why we use this magic constant.  I obtained it by
> -- 
> 2.50.1.windows.1
> 

With that change:
Reviewed-by: Link Mauve <kernel@...kmauve.fr>

-- 
Link Mauve

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)