Commit d111568e authored by Yi Yang's avatar Yi Yang
Browse files

tty: vcc: Add check for kstrdup() in vcc_probe() 

stable inclusion
from stable-v5.10.202
commit 4ef41a7f33ffe1a335e7db7e1564ddc6afad47cc
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFK8
CVE: CVE-2023-52789

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4ef41a7f33ffe1a335e7db7e1564ddc6afad47cc



--------------------------------

[ Upstream commit d81ffb87aaa75f842cd7aa57091810353755b3e6 ]

Add check for the return value of kstrdup() and return the error, if it
fails in order to avoid NULL pointer dereference.

Signed-off-by: default avatarYi Yang <yiyang13@huawei.com>
Reviewed-by: default avatarJiri Slaby <jirislaby@kernel.org>
Link: https://lore.kernel.org/r/20230904035220.48164-1-yiyang13@huawei.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
Signed-off-by: default avatarYi Yang <yiyang13@huawei.com>
parent 15f82233

drivers/tty/vcc.c

+13 −3
Original line number Diff line number Diff line
@@ -587,18 +587,22 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) 
		return -ENOMEM;



	name = kstrdup(dev_name(&vdev->dev), GFP_KERNEL);

	if (!name) {

		rv = -ENOMEM;

		goto free_port;

	}



	rv = vio_driver_init(&port->vio, vdev, VDEV_CONSOLE_CON, vcc_versions,

			     ARRAY_SIZE(vcc_versions), NULL, name);

	if (rv)

		goto free_port;

		goto free_name;



	port->vio.debug = vcc_dbg_vio;

	vcc_ldc_cfg.debug = vcc_dbg_ldc;



	rv = vio_ldc_alloc(&port->vio, &vcc_ldc_cfg, port);

	if (rv)

		goto free_port;

		goto free_name;



	spin_lock_init(&port->lock);
@@ -632,6 +636,11 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) 
		goto unreg_tty;

	}

	port->domain = kstrdup(domain, GFP_KERNEL);

	if (!port->domain) {

		rv = -ENOMEM;

		goto unreg_tty;

	}





	mdesc_release(hp);
@@ -661,8 +670,9 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) 
	vcc_table_remove(port->index);

free_ldc:

	vio_ldc_free(&port->vio);

free_port:

free_name:

	kfree(name);

free_port:

	kfree(port);



	return rv;