kernel: fix possible mtd NULL pointer dereference
Fixes: edf3363959d3c ("kernel: backport mtd dynamic partition patch") Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit a5265497a4f6da158e95d6a450cb2cb6dc085cab)
This commit is contained in:
parent
abf2c60e71
commit
221c6242de
@ -0,0 +1,30 @@
|
|||||||
|
From 7ec4cdb321738d44ae5d405e7b6ac73dfbf99caa Mon Sep 17 00:00:00 2001
|
||||||
|
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
|
||||||
|
Date: Mon, 25 Jul 2022 22:49:25 +0900
|
||||||
|
Subject: [PATCH] mtd: core: check partition before dereference
|
||||||
|
|
||||||
|
syzbot is reporting NULL pointer dereference at mtd_check_of_node() [1],
|
||||||
|
for mtdram test device (CONFIG_MTD_MTDRAM) is not partition.
|
||||||
|
|
||||||
|
Link: https://syzkaller.appspot.com/bug?extid=fe013f55a2814a9e8cfd [1]
|
||||||
|
Reported-by: syzbot <syzbot+fe013f55a2814a9e8cfd@syzkaller.appspotmail.com>
|
||||||
|
Reported-by: kernel test robot <oliver.sang@intel.com>
|
||||||
|
Fixes: ad9b10d1eaada169 ("mtd: core: introduce of support for dynamic partitions")
|
||||||
|
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
|
||||||
|
CC: stable@vger.kernel.org
|
||||||
|
Signed-off-by: Richard Weinberger <richard@nod.at>
|
||||||
|
---
|
||||||
|
drivers/mtd/mtdcore.c | 2 ++
|
||||||
|
1 file changed, 2 insertions(+)
|
||||||
|
|
||||||
|
--- a/drivers/mtd/mtdcore.c
|
||||||
|
+++ b/drivers/mtd/mtdcore.c
|
||||||
|
@@ -602,6 +602,8 @@ static void mtd_check_of_node(struct mtd
|
||||||
|
return;
|
||||||
|
|
||||||
|
/* Check if a partitions node exist */
|
||||||
|
+ if (!mtd_is_partition(mtd))
|
||||||
|
+ return;
|
||||||
|
parent = mtd_get_master(mtd);
|
||||||
|
parent_dn = dev_of_node(&parent->dev);
|
||||||
|
if (!parent_dn)
|
@ -20,7 +20,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
|
|||||||
#include <linux/nvmem-provider.h>
|
#include <linux/nvmem-provider.h>
|
||||||
|
|
||||||
#include <linux/mtd/mtd.h>
|
#include <linux/mtd/mtd.h>
|
||||||
@@ -760,6 +761,15 @@ int add_mtd_device(struct mtd_info *mtd)
|
@@ -762,6 +763,15 @@ int add_mtd_device(struct mtd_info *mtd)
|
||||||
of this try_ nonsense, and no bitching about it
|
of this try_ nonsense, and no bitching about it
|
||||||
either. :) */
|
either. :) */
|
||||||
__module_get(THIS_MODULE);
|
__module_get(THIS_MODULE);
|
||||||
|
@ -17,7 +17,7 @@ Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
|
|||||||
|
|
||||||
--- a/drivers/mtd/mtdcore.c
|
--- a/drivers/mtd/mtdcore.c
|
||||||
+++ b/drivers/mtd/mtdcore.c
|
+++ b/drivers/mtd/mtdcore.c
|
||||||
@@ -1142,6 +1142,44 @@ out_unlock:
|
@@ -1144,6 +1144,44 @@ out_unlock:
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL_GPL(get_mtd_device_nm);
|
EXPORT_SYMBOL_GPL(get_mtd_device_nm);
|
||||||
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user