From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CBC871519AF; Wed, 5 Feb 2025 14:31:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738765897; cv=none; b=qhfup2sgEyXcTrTeOeAIuu+88ddc3yw8SrX4AJ7BzzMmkgIzY8wSlygVgi0nFzW4Up5sYs1Lplp38uB0a9fE6XkG/VADzYlImnSlqRz4I9qb4El7juWfkp4jlxr045g+97MCUJc7wd5gGREM/OOK99zZFhsbCDB4a9bnlRByvIc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738765897; c=relaxed/simple; bh=ur7ZM0ZwmJmbC3vEFKCzcUdtAaW67fWr/B8PKLn3pLk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lpHiCiC79rJYtRqwvJL6TUoqnGF5UyxO5UmoPub2Lt/WFwg7ibnr/BNuRC6DFBE3HrXVFhkEo4AiZecuFYmyNAw2hFJSbYDMHUtWQGkGVvgOvhSXflB0jzBekMe5qRWPec38szI4T247IB17bIY0buhFaH1PJaEMg5lfuJSWWb4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vZx3L/uZ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="vZx3L/uZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 389BFC4CEDD; Wed, 5 Feb 2025 14:31:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1738765897; bh=ur7ZM0ZwmJmbC3vEFKCzcUdtAaW67fWr/B8PKLn3pLk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vZx3L/uZy9e0auFhUqaHrOEpJjo9+Yk1x6OD6bNnNSKqWqrAZNsSbcOWchIVE+DAV zm6p3aCGgYVG/wo9yrhVCExsicgzdbSJtHAPqLhZbe0hRdEpusc9dsObchPbY/E12W TrfCMv+tM7MFc0VJAU8HHRvxA6CvTjig4LMpO+No= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jonathan Cameron , Zijun Hu , Sasha Levin Subject: [PATCH 6.6 310/393] driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() Date: Wed, 5 Feb 2025 14:43:49 +0100 Message-ID: <20250205134432.170095746@linuxfoundation.org> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250205134420.279368572@linuxfoundation.org> References: <20250205134420.279368572@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Zijun Hu [ Upstream commit e128f82f7006991c99a58114f70ef61e937b1ac1 ] There are a potential wild pointer dereferences issue regarding APIs class_dev_iter_(init|next|exit)(), as explained by below typical usage: // All members of @iter are wild pointers. struct class_dev_iter iter; // class_dev_iter_init(@iter, @class, ...) checks parameter @class for // potential class_to_subsys() error, and it returns void type and does // not initialize its output parameter @iter, so caller can not detect // the error and continues to invoke class_dev_iter_next(@iter) even if // @iter still contains wild pointers. class_dev_iter_init(&iter, ...); // Dereference these wild pointers in @iter here once suffer the error. while (dev = class_dev_iter_next(&iter)) { ... }; // Also dereference these wild pointers here. class_dev_iter_exit(&iter); Actually, all callers of these APIs have such usage pattern in kernel tree. Fix by: - Initialize output parameter @iter by memset() in class_dev_iter_init() and give callers prompt by pr_crit() for the error. - Check if @iter is valid in class_dev_iter_next(). Fixes: 7b884b7f24b4 ("driver core: class.c: convert to only use class_to_subsys") Reviewed-by: Jonathan Cameron Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250105-class_fix-v6-1-3a2f1768d4d4@quicinc.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/base/class.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/base/class.c b/drivers/base/class.c index 9cd489a577086..695e7fba580b9 100644 --- a/drivers/base/class.c +++ b/drivers/base/class.c @@ -314,8 +314,12 @@ void class_dev_iter_init(struct class_dev_iter *iter, const struct class *class, struct subsys_private *sp = class_to_subsys(class); struct klist_node *start_knode = NULL; - if (!sp) + memset(iter, 0, sizeof(*iter)); + if (!sp) { + pr_crit("%s: class %p was not registered yet\n", + __func__, class); return; + } if (start) start_knode = &start->p->knode_class; @@ -342,6 +346,9 @@ struct device *class_dev_iter_next(struct class_dev_iter *iter) struct klist_node *knode; struct device *dev; + if (!iter->sp) + return NULL; + while (1) { knode = klist_next(&iter->ki); if (!knode) -- 2.39.5