In the function wmi_dev_match() the variable id is dereferenced without
first performing a NULL check. The variable can for example be NULL if
a WMI driver is registered without specifying the id_table field in
struct wmi_driver.
Add a NULL check and return that the driver can't handle the device if
the variable is NULL.
Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
Signed-off-by: Mattias Jacobsson <[email protected]>
---
drivers/platform/x86/wmi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index bea35be68706..b0f3d8ecd898 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -768,6 +768,9 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
struct wmi_block *wblock = dev_to_wblock(dev);
const struct wmi_device_id *id = wmi_driver->id_table;
+ if (id == NULL)
+ return 0;
+
while (id->guid_string) {
uuid_le driver_guid;
--
2.20.1
On Wed, Jan 30, 2019 at 5:15 PM Mattias Jacobsson <[email protected]> wrote:
>
> In the function wmi_dev_match() the variable id is dereferenced without
> first performing a NULL check. The variable can for example be NULL if
> a WMI driver is registered without specifying the id_table field in
> struct wmi_driver.
>
> Add a NULL check and return that the driver can't handle the device if
> the variable is NULL.
>
Good for me, thanks!
> Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
> Signed-off-by: Mattias Jacobsson <[email protected]>
> ---
> drivers/platform/x86/wmi.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
> index bea35be68706..b0f3d8ecd898 100644
> --- a/drivers/platform/x86/wmi.c
> +++ b/drivers/platform/x86/wmi.c
> @@ -768,6 +768,9 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
> struct wmi_block *wblock = dev_to_wblock(dev);
> const struct wmi_device_id *id = wmi_driver->id_table;
>
> + if (id == NULL)
> + return 0;
> +
> while (id->guid_string) {
> uuid_le driver_guid;
>
> --
> 2.20.1
>
--
With Best Regards,
Andy Shevchenko
On Wed, Jan 30, 2019 at 05:43:34PM +0200, Andy Shevchenko wrote:
> On Wed, Jan 30, 2019 at 5:15 PM Mattias Jacobsson <[email protected]> wrote:
> >
> > In the function wmi_dev_match() the variable id is dereferenced without
> > first performing a NULL check. The variable can for example be NULL if
> > a WMI driver is registered without specifying the id_table field in
> > struct wmi_driver.
> >
> > Add a NULL check and return that the driver can't handle the device if
> > the variable is NULL.
> >
>
> Good for me, thanks!
Queued for testing, thanks Mattias.
--
Darren Hart
VMware Open Source Technology Center