kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/misc/bcm-vk
History
Tuo Li aa97ccc3dc misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() 
[ Upstream commit ba75ecb97d ]

In the function bcm_vk_read(), the pointer entry is checked, indicating
that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
following code may cause null-pointer dereferences:

  struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
  set_msg_id(&tmp_msg, entry->usr_msg_id);
  tmp_msg.size = entry->to_h_blks - 1;

To prevent these possible null-pointer dereferences, copy to_h_msg,
usr_msg_id, and to_h_blks from iter into temporary variables, and return
these temporary variables to the application instead of accessing them
through a potentially NULL entry.

Signed-off-by: Tuo Li <islituo@gmail.com>
Reviewed-by: Scott Branden <scott.branden@broadcom.com>
Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-03-04 07:21:24 -05:00
..
bcm_vk.h misc: bcm_vk: Fix potential deadlock on &vk->ctx_lock 2023-08-04 15:45:19 +02:00
bcm_vk_dev.c misc: bcm_vk: Remove usage of deprecated functions 2022-09-01 16:29:32 +02:00
bcm_vk_msg.c misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() 2026-03-04 07:21:24 -05:00
bcm_vk_msg.h misc: bcm-vk: Annotate struct bcm_vk_wkent with __counted_by 2023-10-05 13:34:03 +02:00
bcm_vk_sg.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
bcm_vk_sg.h misc: bcm-vk: add VK messaging support 2021-01-25 18:44:44 +01:00
bcm_vk_tty.c tty: bcm: convert to u8 and size_t 2023-12-08 12:02:37 +01:00
Kconfig misc: bcm-vk: only support ttyVK if CONFIG_TTY is set 2021-02-04 00:48:58 +01:00
Makefile misc: bcm-vk: only support ttyVK if CONFIG_TTY is set 2021-02-04 00:48:58 +01:00