From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sergey Shtylyov <s.shtylyov@omp.ru>,
Damien Le Moal <damien.lemoal@opensource.wdc.com>,
Sasha Levin <sashal@kernel.org>,
tj@kernel.org, linux-ide@vger.kernel.org
Subject: [PATCH AUTOSEL 5.15 14/41] ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
Date: Mon, 13 Jun 2022 22:06:39 -0400 [thread overview]
Message-ID: <20220614020707.1099487-14-sashal@kernel.org> (raw)
In-Reply-To: <20220614020707.1099487-1-sashal@kernel.org>
From: Sergey Shtylyov <s.shtylyov@omp.ru>
[ Upstream commit bf476fe22aa1851bab4728e0c49025a6a0bea307 ]
In an unlikely (and probably wrong?) case that the 'ppi' parameter of
ata_host_alloc_pinfo() points to an array starting with a NULL pointer,
there's going to be a kernel oops as the 'pi' local variable won't get
reassigned from the initial value of NULL. Initialize 'pi' instead to
'&ata_dummy_port_info' to fix the possible kernel oops for good...
Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index a0343b7c9add..413faa9330b2 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5500,7 +5500,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev,
const struct ata_port_info * const * ppi,
int n_ports)
{
- const struct ata_port_info *pi;
+ const struct ata_port_info *pi = &ata_dummy_port_info;
struct ata_host *host;
int i, j;
@@ -5508,7 +5508,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev,
if (!host)
return NULL;
- for (i = 0, j = 0, pi = NULL; i < host->n_ports; i++) {
+ for (i = 0, j = 0; i < host->n_ports; i++) {
struct ata_port *ap = host->ports[i];
if (ppi[j])
--
2.35.1
next prev parent reply other threads:[~2022-06-14 2:15 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-14 2:06 [PATCH AUTOSEL 5.15 01/41] powerpc/kasan: Silence KASAN warnings in __get_wchan() Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 02/41] ASoC: nau8822: Add operation for internal PLL off and on Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 03/41] drm/amd/display: Read Golden Settings Table from VBIOS Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 04/41] drm/amd/display: Fix DMUB outbox trace in S4 (#4465) Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 05/41] drm/amdkfd: Use mmget_not_zero in MMU notifier Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 06/41] dma-debug: make things less spammy under memory pressure Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 07/41] ASoC: cs42l52: Fix TLV scales for mixer controls Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 08/41] ASoC: cs35l36: Update digital volume TLV Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 09/41] ASoC: cs53l30: Correct number of volume levels on SX controls Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 10/41] ASoC: cs42l52: Correct TLV for Bypass Volume Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 11/41] ASoC: cs42l56: Correct typo in minimum level for SX volume controls Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 12/41] ASoC: cs42l51: Correct minimum value for SX volume control Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 13/41] drm/amdkfd: add pinned BOs to kfd_bo_list Sasha Levin
2022-06-14 2:06 ` Sasha Levin [this message]
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 15/41] quota: Prevent memory allocation recursion while holding dq_lock Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 16/41] ASoC: wm8962: Fix suspend while playing music Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 17/41] ASoC: es8328: Fix event generation for deemphasis control Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 18/41] ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 19/41] Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to dmi_use_low_level_irq Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 20/41] scsi: vmw_pvscsi: Expand vcpuHint to 16 bits Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 21/41] scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 22/41] scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 23/41] scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd completion Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 24/41] scsi: mpt3sas: Fix out-of-bounds compiler warning Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 25/41] scsi: ipr: Fix missing/incorrect resource cleanup in error case Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 26/41] scsi: pmcraid: Fix missing " Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 27/41] ALSA: hda/realtek - Add HW8326 support Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 28/41] virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 29/41] nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 30/41] ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 31/41] net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 32/41] gcc-12: disable '-Wdangling-pointer' warning for now Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 33/41] mellanox: mlx5: avoid uninitialized variable warning with gcc-12 Sasha Levin
2022-06-14 2:06 ` [PATCH AUTOSEL 5.15 34/41] netfs: gcc-12: temporarily disable '-Wattribute-warning' for now Sasha Levin
2022-06-14 2:07 ` [PATCH AUTOSEL 5.15 35/41] MIPS: Loongson-3: fix compile mips cpu_hwmon as module build error Sasha Levin
2022-06-14 2:07 ` [PATCH AUTOSEL 5.15 36/41] random: credit cpu and bootloader seeds by default Sasha Levin
2022-06-14 2:07 ` [PATCH AUTOSEL 5.15 37/41] gpio: dwapb: Don't print error on -EPROBE_DEFER Sasha Levin
2022-06-14 2:07 ` [PATCH AUTOSEL 5.15 38/41] platform/x86/intel: pmc: Support Intel Raptorlake P Sasha Levin
2022-06-14 2:07 ` [PATCH AUTOSEL 5.15 39/41] platform/x86: gigabyte-wmi: Add Z690M AORUS ELITE AX DDR4 support Sasha Levin
2022-06-14 2:07 ` [PATCH AUTOSEL 5.15 40/41] platform/x86: gigabyte-wmi: Add support for B450M DS3H-CF Sasha Levin
2022-06-14 2:07 ` [PATCH AUTOSEL 5.15 41/41] platform/x86/intel: hid: Add Surface Go to VGBS allow list Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220614020707.1099487-14-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=damien.lemoal@opensource.wdc.com \
--cc=linux-ide@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=s.shtylyov@omp.ru \
--cc=stable@vger.kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).