All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Zheyu Ma <zheyuma97@gmail.com>,
	Mauro Carvalho Chehab <mchehab@kernel.org>,
	Sasha Levin <sashal@kernel.org>,
	hverkuil-cisco@xs4all.nl, rdunlap@infradead.org,
	gregkh@linuxfoundation.org, mcgrof@kernel.org,
	andriy.shevchenko@linux.intel.com, hkallweit1@gmail.com,
	linux-media@vger.kernel.org
Subject: [PATCH AUTOSEL 6.9 17/23] media: lgdt3306a: Add a check against null-pointer-def
Date: Mon, 27 May 2024 11:50:18 -0400	[thread overview]
Message-ID: <20240527155123.3863983-17-sashal@kernel.org> (raw)
In-Reply-To: <20240527155123.3863983-1-sashal@kernel.org>

From: Zheyu Ma <zheyuma97@gmail.com>

[ Upstream commit c1115ddbda9c930fba0fdd062e7a8873ebaf898d ]

The driver should check whether the client provides the platform_data.

The following log reveals it:

[   29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40
[   29.610730] Read of size 40 at addr 0000000000000000 by task bash/414
[   29.612820] Call Trace:
[   29.613030]  <TASK>
[   29.613201]  dump_stack_lvl+0x56/0x6f
[   29.613496]  ? kmemdup+0x30/0x40
[   29.613754]  print_report.cold+0x494/0x6b7
[   29.614082]  ? kmemdup+0x30/0x40
[   29.614340]  kasan_report+0x8a/0x190
[   29.614628]  ? kmemdup+0x30/0x40
[   29.614888]  kasan_check_range+0x14d/0x1d0
[   29.615213]  memcpy+0x20/0x60
[   29.615454]  kmemdup+0x30/0x40
[   29.615700]  lgdt3306a_probe+0x52/0x310
[   29.616339]  i2c_device_probe+0x951/0xa90

Link: https://lore.kernel.org/linux-media/20220405095018.3993578-1-zheyuma97@gmail.com
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/dvb-frontends/lgdt3306a.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c
index 2638875924153..231b45632ad5a 100644
--- a/drivers/media/dvb-frontends/lgdt3306a.c
+++ b/drivers/media/dvb-frontends/lgdt3306a.c
@@ -2176,6 +2176,11 @@ static int lgdt3306a_probe(struct i2c_client *client)
 	struct dvb_frontend *fe;
 	int ret;
 
+	if (!client->dev.platform_data) {
+		dev_err(&client->dev, "platform data is mandatory\n");
+		return -EINVAL;
+	}
+
 	config = kmemdup(client->dev.platform_data,
 			 sizeof(struct lgdt3306a_config), GFP_KERNEL);
 	if (config == NULL) {
-- 
2.43.0


  parent reply	other threads:[~2024-05-27 15:52 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-05-27 15:50 [PATCH AUTOSEL 6.9 01/23] drm/amd/display: Exit idle optimizations before HDCP execution Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 02/23] drm/amd/display: Workaround register access in idle race with cursor Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 03/23] ASoC: Intel: sof_cs42l42: rename BT offload quirk Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 04/23] ima: Fix use-after-free on a dentry's dname.name Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 05/23] platform/x86: toshiba_acpi: Add quirk for buttons on Z830 Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 06/23] cgroup/cpuset: Make cpuset hotplug processing synchronous Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 07/23] drm/amd/display: add root clock control function pointer to fix display corruption Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 08/23] ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14 Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 09/23] ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 10/23] drm/lima: add mask irq callback to gp and pp Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 11/23] drm/lima: include pp bcast irq in timeout handler check Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 12/23] drm/lima: mask irqs in timeout path before hard reset Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 13/23] platform/x86: x86-android-tablets: Unregister devices in reverse order Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 14/23] platform/x86: x86-android-tablets: Add Lenovo Yoga Tablet 2 Pro 1380F/L data Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 15/23] ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41 Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 16/23] ALSA: hda/realtek: Add quirks for Lenovo 13X Sasha Levin
2024-05-27 15:50 ` Sasha Levin [this message]
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 18/23] powerpc: make fadump resilient with memory add/remove events Sasha Levin
2024-05-27 15:50   ` Sasha Levin
2024-05-30 11:52   ` Sourabh Jain
2024-05-30 11:52     ` Sourabh Jain
2024-06-18  9:15     ` Pavel Machek
2024-06-18  9:15       ` Pavel Machek
2024-06-19  6:31       ` Michael Ellerman
2024-06-19  6:31         ` Michael Ellerman
2024-06-19 14:30         ` Sasha Levin
2024-06-19 14:30           ` Sasha Levin
2024-06-19 14:32         ` Sasha Levin
2024-06-19 14:32           ` Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 19/23] powerpc/pseries: Enforce hcall result buffer validity and size Sasha Levin
2024-05-27 15:50   ` Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 20/23] media: intel/ipu6: Fix build with !ACPI Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 21/23] media: mtk-vcodec: potential null pointer deference in SCP Sasha Levin
2024-05-27 15:50   ` Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 22/23] powerpc/io: Avoid clang null pointer arithmetic warnings Sasha Levin
2024-05-27 15:50   ` Sasha Levin
2024-05-27 15:50 ` [PATCH AUTOSEL 6.9 23/23] platform/x86: p2sb: Don't init until unassigned resources have been assigned Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240527155123.3863983-17-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=andriy.shevchenko@linux.intel.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=hkallweit1@gmail.com \
    --cc=hverkuil-cisco@xs4all.nl \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    --cc=mcgrof@kernel.org \
    --cc=mchehab@kernel.org \
    --cc=rdunlap@infradead.org \
    --cc=stable@vger.kernel.org \
    --cc=zheyuma97@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.