| Message ID | 20230217132432.487106-1-n.petrova@fintech.ru (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | thunderbolt_tb: add check for return value of 'tb_switch_find_port' | expand |
Hi, On Fri, Feb 17, 2023 at 04:24:32PM +0300, Natalia Petrova wrote: > Return value of 'tb_switch_find_port' has to be checked to avoid > null pointer dereferences in functions tb_tunnel_alloc_dma() and NULL > tb_port_info(). > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 386e5e29d81c ("thunderbolt: Make tb_find_port() available to other files") > Signed-off-by: Natalia Petrova <n.petrova@fintech.ru> > --- > drivers/thunderbolt/tb.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c > index 9853f6c7e81d..5d6cded68d46 100644 > --- a/drivers/thunderbolt/tb.c > +++ b/drivers/thunderbolt/tb.c > @@ -1156,6 +1156,8 @@ static int tb_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd, > sw = tb_to_switch(xd->dev.parent); > dst_port = tb_port_at(xd->route, sw); > nhi_port = tb_switch_find_port(tb->root_switch, TB_TYPE_NHI); > + if (!nhi_port) This really cannot happen in real life. All host routers must have a host interface adapter so I'm not sure if adding these checks do anything else than adding dead code. > + return -EIO; > > mutex_lock(&tb->lock); > tunnel = tb_tunnel_alloc_dma(tb, nhi_port, dst_port, transmit_path, > -- > 2.34.1
diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c index 9853f6c7e81d..5d6cded68d46 100644 --- a/drivers/thunderbolt/tb.c +++ b/drivers/thunderbolt/tb.c @@ -1156,6 +1156,8 @@ static int tb_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd, sw = tb_to_switch(xd->dev.parent); dst_port = tb_port_at(xd->route, sw); nhi_port = tb_switch_find_port(tb->root_switch, TB_TYPE_NHI); + if (!nhi_port) + return -EIO; mutex_lock(&tb->lock); tunnel = tb_tunnel_alloc_dma(tb, nhi_port, dst_port, transmit_path,
Return value of 'tb_switch_find_port' has to be checked to avoid null pointer dereferences in functions tb_tunnel_alloc_dma() and tb_port_info(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 386e5e29d81c ("thunderbolt: Make tb_find_port() available to other files") Signed-off-by: Natalia Petrova <n.petrova@fintech.ru> --- drivers/thunderbolt/tb.c | 2 ++ 1 file changed, 2 insertions(+)