Commit f5eaf532 authored by Rui Miguel Silva's avatar Rui Miguel Silva Committed by liwei
Browse files

greybus: lights: check return of get_channel_from_mode 

mainline inclusion
from mainline-v6.10-rc1
commit a1ba19a1ae7cd1e324685ded4ab563e78fe68648
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D18
CVE: CVE-2024-38637

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a1ba19a1ae7cd1e324685ded4ab563e78fe68648

--------------------------------

If channel for the given node is not found we return null from
get_channel_from_mode. Make sure we validate the return pointer
before using it in two of the missing places.

This was originally reported in [0]:
Found by Linux Verification Center (linuxtesting.org) with SVACE.

[0] https://lore.kernel.org/all/20240301190425.120605-1-m.lobanov@rosalinux.ru



Fixes: 2870b52b ("greybus: lights: add lights implementation")
Reported-by: default avatarMikhail Lobanov <m.lobanov@rosalinux.ru>
Suggested-by: default avatarMikhail Lobanov <m.lobanov@rosalinux.ru>
Suggested-by: default avatarAlex Elder <elder@ieee.org>
Signed-off-by: default avatarRui Miguel Silva <rmfrfs@gmail.com>
Link: https://lore.kernel.org/r/20240325221549.2185265-1-rmfrfs@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatardengquan <dengquan9@huawei.com>
parent 986fcc8f

drivers/staging/greybus/light.c

+7 −1
Original line number Diff line number Diff line
@@ -147,6 +147,9 @@ static int __gb_lights_flash_brightness_set(struct gb_channel *channel) 
		channel = get_channel_from_mode(channel->light,

						GB_CHANNEL_MODE_TORCH);



	if (!channel)

		return -EINVAL;



	/* For not flash we need to convert brightness to intensity */

	intensity = channel->intensity_uA.min +

			(channel->intensity_uA.step * channel->led->brightness);
@@ -549,7 +552,10 @@ static int gb_lights_light_v4l2_register(struct gb_light *light) 
	}



	channel_flash = get_channel_from_mode(light, GB_CHANNEL_MODE_FLASH);

	WARN_ON(!channel_flash);

	if (!channel_flash) {

		dev_err(dev, "failed to get flash channel from mode\n");

		return -EINVAL;

	}



	fled = &channel_flash->fled;