diff options
| author | Yang Yingliang <yangyingliang@huawei.com> | 2021-10-12 14:36:24 +0800 |
|---|---|---|
| committer | Jonathan Cameron <Jonathan.Cameron@huawei.com> | 2021-10-17 16:51:53 +0100 |
| commit | fe6f45f6ba22d625a8500cbad0237c60dd3117ee (patch) | |
| tree | 7813eb09762179bc9ef625a8db20d53ada507b0f /drivers/iio | |
| parent | 604faf9a2ecd1addcc0c10a47e5aaef3c4d4fd6b (diff) | |
| download | linux-fe6f45f6ba22d625a8500cbad0237c60dd3117ee.tar.gz linux-fe6f45f6ba22d625a8500cbad0237c60dd3117ee.tar.bz2 linux-fe6f45f6ba22d625a8500cbad0237c60dd3117ee.zip | |
iio: core: check return value when calling dev_set_name()
I got a null-ptr-deref report when doing fault injection test:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:strlen+0x0/0x20
Call Trace:
start_creating+0x199/0x2f0
debugfs_create_dir+0x25/0x430
__iio_device_register+0x4da/0x1b40 [industrialio]
__devm_iio_device_register+0x22/0x80 [industrialio]
max1027_probe+0x639/0x860 [max1027]
spi_probe+0x183/0x210
really_probe+0x285/0xc30
If dev_set_name() fails, the dev_name() is null, check the return
value of dev_set_name() to avoid the null-ptr-deref.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: e553f182d55b ("staging: iio: core: Introduce debugfs support...")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211012063624.3167460-1-yangyingliang@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Diffstat (limited to 'drivers/iio')
| -rw-r--r-- | drivers/iio/industrialio-core.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c index 2dbb37e09b8c..48fda6a79076 100644 --- a/drivers/iio/industrialio-core.c +++ b/drivers/iio/industrialio-core.c @@ -1664,7 +1664,13 @@ struct iio_dev *iio_device_alloc(struct device *parent, int sizeof_priv) kfree(iio_dev_opaque); return NULL; } - dev_set_name(&indio_dev->dev, "iio:device%d", iio_dev_opaque->id); + + if (dev_set_name(&indio_dev->dev, "iio:device%d", iio_dev_opaque->id)) { + ida_simple_remove(&iio_ida, iio_dev_opaque->id); + kfree(iio_dev_opaque); + return NULL; + } + INIT_LIST_HEAD(&iio_dev_opaque->buffer_list); INIT_LIST_HEAD(&iio_dev_opaque->ioctl_handlers); |