From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Igor Torrente <igormtorrente@gmail.com>
Cc: Pavel Machek <pavel@denx.de>,
linux-kernel@vger.kernel.org, stable@vger.kernel.org,
Ferenc Bakonyi <fero@drama.obuda.kando.hu>,
Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Subject: Re: [PATCH 4.4 28/31] video: hgafb: fix potential NULL pointer dereference
Date: Wed, 26 May 2021 09:12:39 +0200 [thread overview]
Message-ID: <YK305zUnT83u3sRI@kroah.com> (raw)
In-Reply-To: <2a22a7ec-3a47-92dc-5052-c9e7bb2d604b@gmail.com>
On Tue, May 25, 2021 at 06:06:15PM -0300, Igor Torrente wrote:
> Hi Pavel,
>
> On 5/25/21 5:47 PM, Pavel Machek wrote:
> > Hi!
> >
> > > From: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
> > >
> > > commit dc13cac4862cc68ec74348a80b6942532b7735fa upstream.
> > >
> > > The return of ioremap if not checked, and can lead to a NULL to be
> > > assigned to hga_vram. Potentially leading to a NULL pointer
> > > dereference.
> > >
> > > The fix adds code to deal with this case in the error label and
> > > changes how the hgafb_probe handles the return of hga_card_detect.
> >
> > This will break hgafb completely, right? And crash system without hga
> > card as a bonus.
> >
> > > +++ b/drivers/video/fbdev/hgafb.c
> > > @@ -285,6 +285,8 @@ static int hga_card_detect(void)
> > > hga_vram_len = 0x08000;
> > > hga_vram = ioremap(0xb0000, hga_vram_len);
> > > + if (!hga_vram)
> > > + return -ENOMEM;
> > > if (request_region(0x3b0, 12, "hgafb"))
> > > release_io_ports = 1;
> > > @@ -344,13 +346,18 @@ static int hga_card_detect(void)
> > > hga_type_name = "Hercules";
> > > break;
> > > }
> > > - return 1;
> > > + return 0;
> >
> > Ok, so calling convention is now "0 means detected".
> >
> >
> > > @@ -548,13 +555,11 @@ static struct fb_ops hgafb_ops = {
> > > static int hgafb_probe(struct platform_device *pdev)
> > > {
> > > struct fb_info *info;
> > > + int ret;
> > ...
> > > + ret = hga_card_detect();
> > > + if (!ret)
> > > + return ret;
> > > printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n",
> > > hga_type_name, hga_vram_len/1024);
> > >
> >
> > If the card is detected, 0 is returned, !0 is true, and we abort
> > detection....
>
> Yes, you are right! There's a patch that fixes it:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git/commit/?h=char-misc-linus&id=02625c965239b71869326dd0461615f27307ecb3
>
> As far as I know, this patch should be queue up soon to all stable branches.
>
> Greg should have more details about it.
Good catch, I'll go queue that up now, thanks.
greg k-h
next prev parent reply other threads:[~2021-05-26 7:13 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-24 15:24 [PATCH 4.4 00/31] 4.4.270-rc1 review Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 01/31] openrisc: Fix a memory leak Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 02/31] scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 03/31] ptrace: make ptrace() fail if the tracee changed its pid unexpectedly Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 04/31] cifs: fix memory leak in smb2_copychunk_range Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 05/31] ALSA: usb-audio: Validate MS endpoint descriptors Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 06/31] ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 07/31] Revert "ALSA: sb8: add a check for request_region" Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 08/31] xen-pciback: reconfigure also from backend watch handler Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 09/31] dm snapshot: fix a crash when an origin has no snapshots Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 10/31] dm snapshot: fix crash with transient storage and zero chunk size Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 11/31] Revert "video: hgafb: fix potential NULL pointer dereference" Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 12/31] Revert "net: stmicro: fix a missing check of clk_prepare" Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 13/31] Revert "leds: lp5523: fix a missing check of return value of lp55xx_read" Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 14/31] Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe" Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 15/31] Revert "video: imsttfb: fix potential NULL pointer dereferences" Greg Kroah-Hartman
2021-05-24 15:24 ` [PATCH 4.4 16/31] Revert "ecryptfs: replace BUG_ON with error handling code" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 17/31] Revert "gdrom: fix a memory leak bug" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 18/31] cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 19/31] cdrom: gdrom: initialize global variable at init time Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 20/31] Revert "rtlwifi: fix a potential NULL pointer dereference" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 21/31] Revert "qlcnic: Avoid " Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 22/31] Revert "niu: fix missing checks of niu_pci_eeprom_read" Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 23/31] ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 24/31] net: stmicro: handle clk_prepare() failure during init Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 25/31] net: rtlwifi: properly check for alloc_workqueue() failure Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 26/31] leds: lp5523: check return value of lp5xx_read and jump to cleanup code Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 27/31] qlcnic: Add null check after calling netdev_alloc_skb Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 28/31] video: hgafb: fix potential NULL pointer dereference Greg Kroah-Hartman
2021-05-25 20:47 ` Pavel Machek
2021-05-25 21:06 ` Igor Torrente
2021-05-26 7:12 ` Greg Kroah-Hartman [this message]
2021-05-24 15:25 ` [PATCH 4.4 29/31] vgacon: Record video mode changes with VT_RESIZEX Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 30/31] vt: Fix character height handling " Greg Kroah-Hartman
2021-05-24 15:25 ` [PATCH 4.4 31/31] tty: vt: always invoke vc->vc_sw->con_resize callback Greg Kroah-Hartman
2021-05-25 0:20 ` [PATCH 4.4 00/31] 4.4.270-rc1 review Shuah Khan
2021-05-25 14:31 ` Pavel Machek
2021-05-25 15:01 ` Naresh Kamboju
2021-05-25 21:22 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YK305zUnT83u3sRI@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=b.zolnierkie@samsung.com \
--cc=fero@drama.obuda.kando.hu \
--cc=igormtorrente@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=pavel@denx.de \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).