| Message ID | 20250224083707.2532381-1-jianqi.ren.cn@windriver.com (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Johannes Berg |
| Headers | show |
| Series | [6.1.y] ssb: Fix potential NULL pointer dereference in ssb_device_uevent() | expand |
| Context | Check | Description |
|---|---|---|
| jmberg/tree_selection | success | Not a local patch |
On Mon, Feb 24, 2025 at 04:37:07PM +0800, jianqi.ren.cn@windriver.com wrote: > From: Rand Deeb <rand.sec96@gmail.com> > > [ Upstream commit 789c17185fb0f39560496c2beab9b57ce1d0cbe7 ] > > The ssb_device_uevent() function first attempts to convert the 'dev' pointer > to 'struct ssb_device *'. However, it mistakenly dereferences 'dev' before > performing the NULL check, potentially leading to a NULL pointer > dereference if 'dev' is NULL. > > To fix this issue, move the NULL check before dereferencing the 'dev' pointer, > ensuring that the pointer is valid before attempting to use it. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Signed-off-by: Rand Deeb <rand.sec96@gmail.com> > Signed-off-by: Kalle Valo <kvalo@kernel.org> > Link: https://msgid.link/20240306123028.164155-1-rand.sec96@gmail.com > Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com> > Signed-off-by: He Zhe <zhe.he@windriver.com> > --- > Verified the build test. > --- > drivers/ssb/main.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c > index d52e91258e98..aae50a5dfb57 100644 > --- a/drivers/ssb/main.c > +++ b/drivers/ssb/main.c > @@ -341,11 +341,13 @@ static int ssb_bus_match(struct device *dev, struct device_driver *drv) > > static int ssb_device_uevent(struct device *dev, struct kobj_uevent_env *env) > { > - struct ssb_device *ssb_dev = dev_to_ssb_dev(dev); > + struct ssb_device *ssb_dev; > > if (!dev) > return -ENODEV; > > + ssb_dev = dev_to_ssb_dev(dev); This patch does nothing, sorry. It's impossible for dev to be null so no need to verify this and I guess I'll go reject the cve that was assigned to it as well as it's pointless. thanks, greg k-h
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c index d52e91258e98..aae50a5dfb57 100644 --- a/drivers/ssb/main.c +++ b/drivers/ssb/main.c @@ -341,11 +341,13 @@ static int ssb_bus_match(struct device *dev, struct device_driver *drv) static int ssb_device_uevent(struct device *dev, struct kobj_uevent_env *env) { - struct ssb_device *ssb_dev = dev_to_ssb_dev(dev); + struct ssb_device *ssb_dev; if (!dev) return -ENODEV; + ssb_dev = dev_to_ssb_dev(dev); + return add_uevent_var(env, "MODALIAS=ssb:v%04Xid%04Xrev%02X", ssb_dev->id.vendor, ssb_dev->id.coreid,