From 977f6f36a0121b213f9eee4a7deb7fdf073320e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= Date: Tue, 4 Oct 2022 12:04:37 +0200 Subject: kernel: fix possible mtd NULL pointer dereference MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: cae4d089bc1d3 ("kernel: backport mtd dynamic partition patch") Signed-off-by: Rafał Miłecki (cherry picked from commit a5265497a4f6da158e95d6a450cb2cb6dc085cab) --- ...d-core-check-partition-before-dereference.patch | 30 ++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 target/linux/generic/backport-5.10/415-v6.0-mtd-core-check-partition-before-dereference.patch (limited to 'target/linux/generic/backport-5.10/415-v6.0-mtd-core-check-partition-before-dereference.patch') diff --git a/target/linux/generic/backport-5.10/415-v6.0-mtd-core-check-partition-before-dereference.patch b/target/linux/generic/backport-5.10/415-v6.0-mtd-core-check-partition-before-dereference.patch new file mode 100644 index 0000000000..65789ddf2d --- /dev/null +++ b/target/linux/generic/backport-5.10/415-v6.0-mtd-core-check-partition-before-dereference.patch @@ -0,0 +1,30 @@ +From 7ec4cdb321738d44ae5d405e7b6ac73dfbf99caa Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Mon, 25 Jul 2022 22:49:25 +0900 +Subject: [PATCH] mtd: core: check partition before dereference + +syzbot is reporting NULL pointer dereference at mtd_check_of_node() [1], +for mtdram test device (CONFIG_MTD_MTDRAM) is not partition. + +Link: https://syzkaller.appspot.com/bug?extid=fe013f55a2814a9e8cfd [1] +Reported-by: syzbot +Reported-by: kernel test robot +Fixes: ad9b10d1eaada169 ("mtd: core: introduce of support for dynamic partitions") +Signed-off-by: Tetsuo Handa +CC: stable@vger.kernel.org +Signed-off-by: Richard Weinberger +--- + drivers/mtd/mtdcore.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -574,6 +574,8 @@ static void mtd_check_of_node(struct mtd + return; + + /* Check if a partitions node exist */ ++ if (!mtd_is_partition(mtd)) ++ return; + parent = mtd->parent; + parent_dn = dev_of_node(&parent->dev); + if (!parent_dn) -- cgit v1.2.3