Commit 51f738b9 authored by Huai-Yuan Liu's avatar Huai-Yuan Liu Committed by Chen Ridong
Browse files

ppdev: Add an error check in register_device 

mainline inclusion
from mainline-v6.10-rc
commit fbf740aeb86a4fe82ad158d26d711f2f3be79b3e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9T6MM
CVE: CVE-2024-36015

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fbf740aeb86a4fe82ad158d26d711f2f3be79b3e



----------------------------------------------------------------------

In register_device, the return value of ida_simple_get is unchecked,
in witch ida_simple_get will use an invalid index value.

To address this issue, index should be checked after ida_simple_get. When
the index value is abnormal, a warning message should be printed, the port
should be dropped, and the value should be recorded.

Fixes: 9a69645d ("ppdev: fix registering same device name")
Signed-off-by: default avatarHuai-Yuan Liu <qq810974084@gmail.com>
Link: https://lore.kernel.org/r/20240412083840.234085-1-qq810974084@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarChen Ridong <chenridong@huawei.com>
parent 2850f834

drivers/char/ppdev.c

+11 −4
Original line number Diff line number Diff line
@@ -296,28 +296,35 @@ static int register_device(int minor, struct pp_struct *pp) 
	if (!port) {

		pr_warn("%s: no associated port!\n", name);

		rc = -ENXIO;

		goto err;

		goto err_free_name;

	}



	index = ida_alloc(&ida_index, GFP_KERNEL);

	if (index < 0) {

		pr_warn("%s: failed to get index!\n", name);

		rc = index;

		goto err_put_port;

	}



	memset(&ppdev_cb, 0, sizeof(ppdev_cb));

	ppdev_cb.irq_func = pp_irq;

	ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0;

	ppdev_cb.private = pp;

	pdev = parport_register_dev_model(port, name, &ppdev_cb, index);

	parport_put_port(port);



	if (!pdev) {

		pr_warn("%s: failed to register device!\n", name);

		rc = -ENXIO;

		ida_free(&ida_index, index);

		goto err;

		goto err_put_port;

	}



	pp->pdev = pdev;

	pp->index = index;

	dev_dbg(&pdev->dev, "registered pardevice\n");

err:

err_put_port:

	parport_put_port(port);

err_free_name:

	kfree(name);

	return rc;

}