Commit 8ac21877 authored by Kunwu Chan's avatar Kunwu Chan Committed by openeuler-sync-bot
Browse files

powerpc/imc-pmu: Add a null pointer check in update_events_in_group() 

mainline inclusion
from mainline-v6.8-rc1
commit 0a233867a39078ebb0f575e2948593bbff5826b3
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9J4
CVE: CVE-2023-52675

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0a233867a39078ebb0f575e2948593bbff5826b3



--------------------------------

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.

Fixes: 885dcd70 ("powerpc/perf: Add nest IMC PMU support")
Signed-off-by: default avatarKunwu Chan <chentao@kylinos.cn>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn


Signed-off-by: default avatarLuo Gengkun <luogengkun2@huawei.com>
(cherry picked from commit b497680d)
parent 40e4eb12

arch/powerpc/perf/imc-pmu.c

+6 −0
Original line number Diff line number Diff line
@@ -292,6 +292,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) 
	attr_group->attrs = attrs;

	do {

		ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value);

		if (!ev_val_str)

			continue;

		dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str);

		if (!dev_str)

			continue;
@@ -299,6 +301,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) 
		attrs[j++] = dev_str;

		if (pmu->events[i].scale) {

			ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name);

			if (!ev_scale_str)

				continue;

			dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale);

			if (!dev_str)

				continue;
@@ -308,6 +312,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) 


		if (pmu->events[i].unit) {

			ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name);

			if (!ev_unit_str)

				continue;

			dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit);

			if (!dev_str)

				continue;