Commit beefe46c authored by 蒋家盛's avatar 蒋家盛 Committed by Cai Xinchen
Browse files

HID: intel_ish-hid: Add check for ishtp_dma_tx_map 

stable inclusion
from stable-v5.10.166
commit 7b4516ba56f1fcb13ffc91912f3074e28362228d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7FCLX
CVE: CVE-2023-3358

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7b4516ba56f1fcb13ffc91912f3074e28362228d



----------------------------------------

[ Upstream commit b3d40c3e ]

As the kcalloc may return NULL pointer,
it should be better to check the ishtp_dma_tx_map
before use in order to avoid NULL pointer dereference.

Fixes: 3703f53b ("HID: intel_ish-hid: ISH Transport layer")
Signed-off-by: default avatarJiasheng Jiang <jiasheng@iscas.ac.cn>
Acked-by: default avatarSrinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarCai Xinchen <caixinchen1@huawei.com>
parent 5a1d2ec2

drivers/hid/intel-ish-hid/ishtp/dma-if.c

+10 −0
Original line number Diff line number Diff line
@@ -104,6 +104,11 @@ void *ishtp_cl_get_dma_send_buf(struct ishtp_device *dev, 
	int required_slots = (size / DMA_SLOT_SIZE)

		+ 1 * (size % DMA_SLOT_SIZE != 0);



	if (!dev->ishtp_dma_tx_map) {

		dev_err(dev->devc, "Fail to allocate Tx map\n");

		return NULL;

	}



	spin_lock_irqsave(&dev->ishtp_dma_tx_lock, flags);

	for (i = 0; i <= (dev->ishtp_dma_num_slots - required_slots); i++) {

		free = 1;
@@ -150,6 +155,11 @@ void ishtp_cl_release_dma_acked_mem(struct ishtp_device *dev, 
		return;

	}



	if (!dev->ishtp_dma_tx_map) {

		dev_err(dev->devc, "Fail to allocate Tx map\n");

		return;

	}



	i = (msg_addr - dev->ishtp_host_dma_tx_buf) / DMA_SLOT_SIZE;

	spin_lock_irqsave(&dev->ishtp_dma_tx_lock, flags);

	for (j = 0; j < acked_slots; j++) {