2021-07-29 12:05:46

by Christophe JAILLET

Subject: [PATCH] dmaengine: idxd: Fix a possible NULL pointer dereference

'device_driver_attach()' dereferences its first argument (i.e. 'alt_drv')
so it must not be NULL.
Simplify the error handling logic about NULL 'alt_drv' in order to be
more robust and future-proof.

Fixes: 568b2126466f ("dmaengine: idxd: fix uninit var for alt_drv")
Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode")

Signed-off-by: Christophe JAILLET <[email protected]>
---
drivers/dma/idxd/compat.c | 15 ++++-----------
1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/drivers/dma/idxd/compat.c b/drivers/dma/idxd/compat.c
index d7616c240dcd..3df21615f888 100644
--- a/drivers/dma/idxd/compat.c
+++ b/drivers/dma/idxd/compat.c
@@ -45,23 +45,16 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf, size_t cou
idxd_dev = confdev_to_idxd_dev(dev);
if (is_idxd_dev(idxd_dev)) {
alt_drv = driver_find("idxd", bus);
- if (!alt_drv)
- return -ENODEV;
} else if (is_idxd_wq_dev(idxd_dev)) {
struct idxd_wq *wq = confdev_to_wq(dev);

- if (is_idxd_wq_kernel(wq)) {
+ if (is_idxd_wq_kernel(wq))
alt_drv = driver_find("dmaengine", bus);
- if (!alt_drv)
- return -ENODEV;
- } else if (is_idxd_wq_user(wq)) {
+ else if (is_idxd_wq_user(wq))
alt_drv = driver_find("user", bus);
- if (!alt_drv)
- return -ENODEV;
- } else {
- return -ENODEV;
- }
}
+ if (!alt_drv)
+ return -ENODEV;

rc = device_driver_attach(alt_drv, dev);
if (rc < 0)
--
2.30.2

2021-07-29 16:18:34

by Dave Jiang

Subject: Re: [PATCH] dmaengine: idxd: Fix a possible NULL pointer dereference

On 7/29/2021 5:04 AM, Christophe JAILLET wrote:
> 'device_driver_attach()' dereferences its first argument (i.e. 'alt_drv')
> so it must not be NULL.
> Simplify the error handling logic about NULL 'alt_drv' in order to be
> more robust and future-proof.
>
> Fixes: 568b2126466f ("dmaengine: idxd: fix uninit var for alt_drv")
> Fixes: 6e7f3ee97bbe ("dmaengine: idxd: move dsa_drv support to compatible mode")
>
> Signed-off-by: Christophe JAILLET <[email protected]>


Thanks for the cleanup.

Acked-by: Dave Jiang <[email protected]>

> ---
> drivers/dma/idxd/compat.c | 15 ++++-----------
> 1 file changed, 4 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/dma/idxd/compat.c b/drivers/dma/idxd/compat.c
> index d7616c240dcd..3df21615f888 100644
> --- a/drivers/dma/idxd/compat.c
> +++ b/drivers/dma/idxd/compat.c
> @@ -45,23 +45,16 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf, size_t cou
> idxd_dev = confdev_to_idxd_dev(dev);
> if (is_idxd_dev(idxd_dev)) {
> alt_drv = driver_find("idxd", bus);
> - if (!alt_drv)
> - return -ENODEV;
> } else if (is_idxd_wq_dev(idxd_dev)) {
> struct idxd_wq *wq = confdev_to_wq(dev);
>
> - if (is_idxd_wq_kernel(wq)) {
> + if (is_idxd_wq_kernel(wq))
> alt_drv = driver_find("dmaengine", bus);
> - if (!alt_drv)
> - return -ENODEV;
> - } else if (is_idxd_wq_user(wq)) {
> + else if (is_idxd_wq_user(wq))
> alt_drv = driver_find("user", bus);
> - if (!alt_drv)
> - return -ENODEV;
> - } else {
> - return -ENODEV;
> - }
> }
> + if (!alt_drv)
> + return -ENODEV;
>
> rc = device_driver_attach(alt_drv, dev);
> if (rc < 0)

2021-08-02 07:09:16

by Vinod Koul

Subject: Re: [PATCH] dmaengine: idxd: Fix a possible NULL pointer dereference

On 29-07-21, 14:04, Christophe JAILLET wrote:
> 'device_driver_attach()' dereferences its first argument (i.e. 'alt_drv')
> so it must not be NULL.
> Simplify the error handling logic about NULL 'alt_drv' in order to be
> more robust and future-proof.

Applied, thanks

--
~Vinod