Skip to content

Commit ea298e6

Browse files
author
Vasily Gorbik
committed
s390/cio: avoid calling strlen on null pointer
Fix the following kasan finding: BUG: KASAN: global-out-of-bounds in ccwgroup_create_dev+0x850/0x1140 Read of size 1 at addr 0000000000000000 by task systemd-udevd.r/561 CPU: 30 PID: 561 Comm: systemd-udevd.r Tainted: G B Hardware name: IBM 3906 M04 704 (LPAR) Call Trace: ([<0000000231b3db7e>] show_stack+0x14e/0x1a8) [<0000000233826410>] dump_stack+0x1d0/0x218 [<000000023216fac4>] print_address_description+0x64/0x380 [<000000023216f5a8>] __kasan_report+0x138/0x168 [<00000002331b8378>] ccwgroup_create_dev+0x850/0x1140 [<00000002332b618a>] group_store+0x3a/0x50 [<00000002323ac706>] kernfs_fop_write+0x246/0x3b8 [<00000002321d409a>] vfs_write+0x132/0x450 [<00000002321d47da>] ksys_write+0x122/0x208 [<0000000233877102>] system_call+0x2a6/0x2c8 Triggered by: openat(AT_FDCWD, "/sys/bus/ccwgroup/drivers/qeth/group", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 16 write(16, "0.0.bd00,0.0.bd01,0.0.bd02", 26) = 26 The problem is that __get_next_id in ccwgroup_create_dev might set "buf" buffer pointer to NULL and explicit check for that is required. Cc: [email protected] Reviewed-by: Sebastian Ott <[email protected]> Signed-off-by: Vasily Gorbik <[email protected]>
1 parent f3122a7 commit ea298e6

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/s390/cio/ccwgroup.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -372,7 +372,7 @@ int ccwgroup_create_dev(struct device *parent, struct ccwgroup_driver *gdrv,
372372
goto error;
373373
}
374374
/* Check for trailing stuff. */
375-
if (i == num_devices && strlen(buf) > 0) {
375+
if (i == num_devices && buf && strlen(buf) > 0) {
376376
rc = -EINVAL;
377377
goto error;
378378
}

0 commit comments

Comments
 (0)