From: Wang Wensheng <wangwensheng4@huawei.com>
To: <jic23@kernel.org>, <lars@metafoo.de>,
<alexandru.ardelean@analog.com>, <linux-iio@vger.kernel.org>,
<linux-kernel@vger.kernel.org>
Cc: <rui.xiang@huawei.com>
Subject: [PATCH -next] iio: buffer: Check the return value of kstrdup_const()
Date: Mon, 11 Oct 2021 12:58:46 +0000 [thread overview]
Message-ID: <20211011125846.66553-1-wangwensheng4@huawei.com> (raw)
We should check the duplication of attr.name properly in
iio_buffer_wrap_attr() or a null-pointer-dereference would
occur on destroying the related sysfs file.
This issue is found by fault-injection.
BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
RIP: 0010:strlen+0x0/0x20
Call Trace:
kernfs_name_hash+0x1c/0xb0
kernfs_find_ns+0xc6/0x160
kernfs_remove_by_name_ns+0x5c/0xb0
remove_files.isra.1+0x42/0x90
internal_create_group+0x42f/0x460
internal_create_groups+0x49/0xc0
device_add+0xb5b/0xbe0
? kobject_get+0x90/0xa0
cdev_device_add+0x2b/0x90
__iio_device_register+0xa56/0xb40
Fixes: 15097c7a1adc ("iio: buffer: wrap all buffer attributes into iio_dev_attr")
Reported-by: Hulk Robot<hulkci@huawei.com>
Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
---
drivers/iio/industrialio-buffer.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index c648e9553edd..f4011c477bac 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -1312,6 +1312,8 @@ static struct attribute *iio_buffer_wrap_attr(struct iio_buffer *buffer,
iio_attr->buffer = buffer;
memcpy(&iio_attr->dev_attr, dattr, sizeof(iio_attr->dev_attr));
iio_attr->dev_attr.attr.name = kstrdup_const(attr->name, GFP_KERNEL);
+ if (!iio_attr->dev_attr.attr.name)
+ return NULL;
sysfs_attr_init(&iio_attr->dev_attr.attr);
list_add(&iio_attr->l, &buffer->buffer_attr_list);
--
2.17.1
next reply other threads:[~2021-10-11 13:00 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-11 12:58 Wang Wensheng [this message]
2021-10-17 13:49 ` [PATCH -next] iio: buffer: Check the return value of kstrdup_const() Jonathan Cameron
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211011125846.66553-1-wangwensheng4@huawei.com \
--to=wangwensheng4@huawei.com \
--cc=alexandru.ardelean@analog.com \
--cc=jic23@kernel.org \
--cc=lars@metafoo.de \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rui.xiang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.