|
 |
26ccd9 |
From c55b18181281b2fffadb9e0e8955d74b8b719349 Mon Sep 17 00:00:00 2001
|
|
|
26ccd9 |
From: Vishal Verma <vishal.l.verma@intel.com>
|
|
|
26ccd9 |
Date: Fri, 17 Dec 2021 19:25:11 -0700
|
|
|
26ccd9 |
Subject: [PATCH 061/217] libcxl: fix potential NULL dereference in
|
|
|
26ccd9 |
cxl_memdev_nvdimm_bridge_active()
|
|
|
26ccd9 |
|
|
|
26ccd9 |
Static analysis points out that the function above has a check for
|
|
|
26ccd9 |
'if (!bridge)', implying that bridge maybe NULL, but it is dereferenced
|
|
|
26ccd9 |
before the check, which could result in a NULL dereference.
|
|
|
26ccd9 |
|
|
|
26ccd9 |
Fix this by moving any accesses to the bridge structure after the NULL
|
|
|
26ccd9 |
check.
|
|
|
26ccd9 |
|
|
|
26ccd9 |
Link: https://lore.kernel.org/r/20211218022511.314928-1-vishal.l.verma@intel.com
|
|
|
26ccd9 |
Cc: Dan Williams <dan.j.williams@intel.com>
|
|
|
26ccd9 |
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
|
|
|
26ccd9 |
Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
|
|
|
26ccd9 |
---
|
|
|
26ccd9 |
cxl/lib/libcxl.c | 7 +++++--
|
|
|
26ccd9 |
1 file changed, 5 insertions(+), 2 deletions(-)
|
|
|
26ccd9 |
|
|
|
26ccd9 |
diff --git a/cxl/lib/libcxl.c b/cxl/lib/libcxl.c
|
|
|
26ccd9 |
index f0664be..3390eb9 100644
|
|
|
26ccd9 |
--- a/cxl/lib/libcxl.c
|
|
|
26ccd9 |
+++ b/cxl/lib/libcxl.c
|
|
|
26ccd9 |
@@ -420,12 +420,15 @@ CXL_EXPORT int cxl_memdev_nvdimm_bridge_active(struct cxl_memdev *memdev)
|
|
|
26ccd9 |
{
|
|
|
26ccd9 |
struct cxl_ctx *ctx = cxl_memdev_get_ctx(memdev);
|
|
|
26ccd9 |
struct cxl_nvdimm_bridge *bridge = memdev->bridge;
|
|
|
26ccd9 |
- char *path = bridge->dev_buf;
|
|
|
26ccd9 |
- int len = bridge->buf_len;
|
|
|
26ccd9 |
+ char *path;
|
|
|
26ccd9 |
+ int len;
|
|
|
26ccd9 |
|
|
|
26ccd9 |
if (!bridge)
|
|
|
26ccd9 |
return 0;
|
|
|
26ccd9 |
|
|
|
26ccd9 |
+ path = bridge->dev_buf;
|
|
|
26ccd9 |
+ len = bridge->buf_len;
|
|
|
26ccd9 |
+
|
|
|
26ccd9 |
if (snprintf(path, len, "%s/driver", bridge->dev_path) >= len) {
|
|
|
26ccd9 |
err(ctx, "%s: nvdimm bridge buffer too small!\n",
|
|
|
26ccd9 |
cxl_memdev_get_devname(memdev));
|
|
|
26ccd9 |
--
|
|
|
26ccd9 |
2.27.0
|
|
|
26ccd9 |
|