[PATCH v3] driver: tx2: Add NULL check in tx2_uncore_pmu_register

[PATCH v3] driver: tx2: Add NULL check in tx2_uncore_pmu_register

[Henry Martin]

devm_kasprintf() returns NULL if memory allocation fails. Currently,
tx2_uncore_pmu_register() does not check for this case, leading to a
NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue.
No automated tools were used; this was found during manual code review.

Fixes: 69c32972d593 ("drivers/perf: Add Cavium ThunderX2 SoC UNCORE PMU driver")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
V2 -> V3: Dropped the redundant error message as suggested by Markus.

 drivers/perf/thunderx2_pmu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/perf/thunderx2_pmu.c b/drivers/perf/thunderx2_pmu.c
index 6ed4707bd6bb..24443ab5d998 100644
--- a/drivers/perf/thunderx2_pmu.c
+++ b/drivers/perf/thunderx2_pmu.c
@@ -738,7 +738,8 @@ static int tx2_uncore_pmu_register(
 
 	tx2_pmu->pmu.name = devm_kasprintf(dev, GFP_KERNEL,
 			"%s", name);
-
+	if (!tx2_pmu->pmu.name)
+		return -ENOMEM;
 	return perf_pmu_register(&tx2_pmu->pmu, tx2_pmu->pmu.name, -1);
 }
 
-- 
2.34.1

Re: [PATCH v3] driver: tx2: Add NULL check in tx2_uncore_pmu_register

[Markus Elfring]

> devm_kasprintf() returns NULL if memory allocation fails.

                call                                 failed?


>                                                           Currently,
> tx2_uncore_pmu_register() does not check for this case, leading to a
> NULL pointer dereference.

This (temporary) view should be reconsidered in more detail.


> No automated tools were used;

Further development tools can help for such analysis attempts.


>                               this was found during manual code review.

This approach might be misleading so far.


…
> +++ b/drivers/perf/thunderx2_pmu.c
> @@ -738,7 +738,8 @@ static int tx2_uncore_pmu_register(
>
>  	tx2_pmu->pmu.name = devm_kasprintf(dev, GFP_KERNEL,
>  			"%s", name);
> -
> +	if (!tx2_pmu->pmu.name)
> +		return -ENOMEM;
>  	return perf_pmu_register(&tx2_pmu->pmu, tx2_pmu->pmu.name, -1);
>  }
…

Should your source code analysis approaches take further implementation details
better into account?

Example:
perf_pmu_register()
https://elixir.bootlin.com/linux/v6.14-rc6/source/kernel/events/core.c#L11859-L11862
…
	if (WARN_ONCE(!name, "Can not register anonymous pmu.\n")) {
		ret = -EINVAL;
…


Regards,
Markus