[PATCH] parisc: led: Fix potential null-ptr-deref in start_task()

[PATCH] parisc: led: Fix potential null-ptr-deref in start_task()

[Shang XiaoJing]

start_task() calls create_singlethread_workqueue() and not checked the
ret value, which may return NULL. And a null-ptr-deref may happen:

start_task()
    create_singlethread_workqueue() # failed, led_wq is NULL
    queue_delayed_work()
        queue_delayed_work_on()
            __queue_delayed_work()  # warning here, but continue
                __queue_work()      # access wq->flags, null-ptr-deref

Check the ret value and return -ENOMEM if it is NULL.

Fixes: 3499495205a6 ("[PARISC] Use work queue in LED/LCD driver instead of tasklet.")
Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
---
 drivers/parisc/led.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
index d4be9d2ee74d..8bdc5e043831 100644
--- a/drivers/parisc/led.c
+++ b/drivers/parisc/led.c
@@ -137,6 +137,9 @@ static int start_task(void)
 
 	/* Create the work queue and queue the LED task */
 	led_wq = create_singlethread_workqueue("led_wq");	
+	if (!led_wq)
+		return -ENOMEM;
+
 	queue_delayed_work(led_wq, &led_task, 0);
 
 	return 0;
-- 
2.17.1

Re: [PATCH] parisc: led: Fix potential null-ptr-deref in start_task()

[Helge Deller]

On 11/17/22 03:45, Shang XiaoJing wrote:
> start_task() calls create_singlethread_workqueue() and not checked the
> ret value, which may return NULL. And a null-ptr-deref may happen:
>
> start_task()
>      create_singlethread_workqueue() # failed, led_wq is NULL
>      queue_delayed_work()
>          queue_delayed_work_on()
>              __queue_delayed_work()  # warning here, but continue
>                  __queue_work()      # access wq->flags, null-ptr-deref
>
> Check the ret value and return -ENOMEM if it is NULL.
>
> Fixes: 3499495205a6 ("[PARISC] Use work queue in LED/LCD driver instead of tasklet.")
> Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>

applied.

Thanks!
Helge

> ---
>   drivers/parisc/led.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
> index d4be9d2ee74d..8bdc5e043831 100644
> --- a/drivers/parisc/led.c
> +++ b/drivers/parisc/led.c
> @@ -137,6 +137,9 @@ static int start_task(void)
>
>   	/* Create the work queue and queue the LED task */
>   	led_wq = create_singlethread_workqueue("led_wq");
> +	if (!led_wq)
> +		return -ENOMEM;
> +
>   	queue_delayed_work(led_wq, &led_task, 0);
>
>   	return 0;