| Message ID | 20230925080844.32699-1-dinghao.liu@zju.edu.cn (mailing list archive) |
|---|---|
| State | Mainlined, archived |
| Headers | show |
| Series | ACPI: video: Fix a null-pointer-dereference in acpi_video_bus_add | expand |
On Mon, Sep 25, 2023 at 10:09 AM Dinghao Liu <dinghao.liu@zju.edu.cn> wrote: > > acpi_video_bus_add_notify_handler() could free video->input and > set it to NULL on failure, but this failure will be missed in its > caller acpi_video_bus_add(). As a result, when an error happens in > acpi_dev_install_notify_handler(), acpi_video_bus_add() will call > acpi_video_bus_remove_notify_handler(), where a potential null pointer > video->input is dereferenced in input_unregister_device(). > > Fix this by adding a return value check and adjusting the following > error handling code. > > Fixes: 6f7016819766 ("ACPI: video: Install Notify() handler directly") > Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> > --- > drivers/acpi/acpi_video.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c > index 948e31f7ce6e..b411948594ff 100644 > --- a/drivers/acpi/acpi_video.c > +++ b/drivers/acpi/acpi_video.c > @@ -2057,7 +2057,9 @@ static int acpi_video_bus_add(struct acpi_device *device) > !auto_detect) > acpi_video_bus_register_backlight(video); > > - acpi_video_bus_add_notify_handler(video); > + error = acpi_video_bus_add_notify_handler(video); > + if (error) > + goto err_del; > > error = acpi_dev_install_notify_handler(device, ACPI_DEVICE_NOTIFY, > acpi_video_bus_notify); > @@ -2067,10 +2069,11 @@ static int acpi_video_bus_add(struct acpi_device *device) > return 0; > > err_remove: > + acpi_video_bus_remove_notify_handler(video); > +err_del: > mutex_lock(&video_list_lock); > list_del(&video->entry); > mutex_unlock(&video_list_lock); > - acpi_video_bus_remove_notify_handler(video); > acpi_video_bus_unregister_backlight(video); > err_put_video: > acpi_video_bus_put_devices(video); > -- Applied as 6.6-rc material, thanks!
diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c index 948e31f7ce6e..b411948594ff 100644 --- a/drivers/acpi/acpi_video.c +++ b/drivers/acpi/acpi_video.c @@ -2057,7 +2057,9 @@ static int acpi_video_bus_add(struct acpi_device *device) !auto_detect) acpi_video_bus_register_backlight(video); - acpi_video_bus_add_notify_handler(video); + error = acpi_video_bus_add_notify_handler(video); + if (error) + goto err_del; error = acpi_dev_install_notify_handler(device, ACPI_DEVICE_NOTIFY, acpi_video_bus_notify); @@ -2067,10 +2069,11 @@ static int acpi_video_bus_add(struct acpi_device *device) return 0; err_remove: + acpi_video_bus_remove_notify_handler(video); +err_del: mutex_lock(&video_list_lock); list_del(&video->entry); mutex_unlock(&video_list_lock); - acpi_video_bus_remove_notify_handler(video); acpi_video_bus_unregister_backlight(video); err_put_video: acpi_video_bus_put_devices(video);
acpi_video_bus_add_notify_handler() could free video->input and set it to NULL on failure, but this failure will be missed in its caller acpi_video_bus_add(). As a result, when an error happens in acpi_dev_install_notify_handler(), acpi_video_bus_add() will call acpi_video_bus_remove_notify_handler(), where a potential null pointer video->input is dereferenced in input_unregister_device(). Fix this by adding a return value check and adjusting the following error handling code. Fixes: 6f7016819766 ("ACPI: video: Install Notify() handler directly") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> --- drivers/acpi/acpi_video.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)