Received-SPF: pass (google.com: domain of linux-kernel+bounces-95577-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Roman Smirnov <r.smirnov@omp.ru>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, "Rafael J. Wysocki"
	<rafael@kernel.org>
CC: Roman Smirnov <r.smirnov@omp.ru>, Sergey Shtylyov <s.shtylyov@omp.ru>,
	Karina Yankevich <k.yankevich@omp.ru>, <linux-kernel@vger.kernel.org>,
	<lvc-project@linuxtesting.org>
Subject: [PATCH] drivers: core: prevent dereferencing of a null pointer in device_move()
Date: Thu, 7 Mar 2024 16:11:41 +0300
Message-ID: <20240307131141.16668-1-r.smirnov@omp.ru>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
X-KSE-Attachment-Filter-Triggered-Filters: Clean
X-KSE-BulkMessagesFiltering-Scan-Result: InTheLimit

Parameter new_parent can be equal to NULL. In this case if the 
drm_order parameter is equal to DRM_ORDER_DEV_AFTER_PARENT or
DRM_ORDER_PARENT_BEFORE_DEV, a null pointer will be dereferenced.

Found by Linux Verification Center (linuxtesting.org) with Svace.

Signed-off-by: Roman Smirnov <r.smirnov@omp.ru>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
---
 drivers/base/core.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 9828da9b933c..9af7ccf56f42 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -4593,10 +4593,18 @@ int device_move(struct device *dev, struct device *new_parent,
 	case DPM_ORDER_NONE:
 		break;
 	case DPM_ORDER_DEV_AFTER_PARENT:
+		if (!new_parent) {
+			error = -EINVAL;
+			goto out;
+		}
 		device_pm_move_after(dev, new_parent);
 		devices_kset_move_after(dev, new_parent);
 		break;
 	case DPM_ORDER_PARENT_BEFORE_DEV:
+		if (!new_parent) {
+			error = -EINVAL;
+			goto out;
+		}
 		device_pm_move_before(new_parent, dev);
 		devices_kset_move_before(new_parent, dev);
 		break;
-- 
2.34.1