From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
To: gregkh@linuxfoundation.org
Cc: linux-kernel@vger.kernel.org,
Nicholas Johnson <nicholas.johnson-opensource@outlook.com.au>,
Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Subject: [PATCH 09/14] nvmem: check for NULL reg_read and reg_write before dereferencing
Date: Tue, 10 Mar 2020 13:22:52 +0000 [thread overview]
Message-ID: <20200310132257.23358-10-srinivas.kandagatla@linaro.org> (raw)
In-Reply-To: <20200310132257.23358-1-srinivas.kandagatla@linaro.org>
From: Nicholas Johnson <nicholas.johnson-opensource@outlook.com.au>
Return -EPERM if reg_read is NULL in bin_attr_nvmem_read() or if
reg_write is NULL in bin_attr_nvmem_write().
This prevents NULL dereferences such as the one described in
03cd45d2e219 ("thunderbolt: Prevent crash if non-active NVMem file is
read")
Signed-off-by: Nicholas Johnson <nicholas.johnson-opensource@outlook.com.au>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
---
drivers/nvmem/nvmem-sysfs.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/nvmem/nvmem-sysfs.c b/drivers/nvmem/nvmem-sysfs.c
index 9e0c429cd08a..8759c4470012 100644
--- a/drivers/nvmem/nvmem-sysfs.c
+++ b/drivers/nvmem/nvmem-sysfs.c
@@ -56,6 +56,9 @@ static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj,
count = round_down(count, nvmem->word_size);
+ if (!nvmem->reg_read)
+ return -EPERM;
+
rc = nvmem->reg_read(nvmem->priv, pos, buf, count);
if (rc)
@@ -90,6 +93,9 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj,
count = round_down(count, nvmem->word_size);
+ if (!nvmem->reg_write)
+ return -EPERM;
+
rc = nvmem->reg_write(nvmem->priv, pos, buf, count);
if (rc)
--
2.21.0
next prev parent reply other threads:[~2020-03-10 13:23 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-10 13:22 [PATCH 00/14] nvmem: patches for 5.7 Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 01/14] nvmem: imx: ocotp: add i.MX8MP support Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 02/14] nvmem: core: add nvmem_cell_read_common Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 03/14] nvmem: core: add nvmem_cell_read_u64 Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 04/14] nvmem: remove a stray newline in nvmem_register() Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 05/14] nvmem: add a newline for readability Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 06/14] nvmem: fix memory leak in error path Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 07/14] nvmem: release the write-protect pin Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 08/14] nvmem: core: validate nvmem config before parsing Srinivas Kandagatla
2020-03-10 13:22 ` Srinivas Kandagatla [this message]
2020-03-10 13:22 ` [PATCH 10/14] nvmem: imx-ocotp: Drop unnecessary initializations Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 11/14] Bindings: nvmem: add bindings for JZ4780 efuse Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 12/14] nvmem: add driver " Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 13/14] Documentation: ABI: nvmem: add documentation for JZ4780 efuse ABI Srinivas Kandagatla
2020-03-10 13:22 ` [PATCH 14/14] nvmem: jz4780-efuse: fix build warnings on ARCH=x86_64 or riscv Srinivas Kandagatla
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200310132257.23358-10-srinivas.kandagatla@linaro.org \
--to=srinivas.kandagatla@linaro.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nicholas.johnson-opensource@outlook.com.au \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).