Re: [PATCH v2] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle

[Chen Zhongjin]

Hi,

On 2022/11/11 14:18, Greg KH wrote:
> On Fri, Nov 11, 2022 at 09:53:26AM +0800, Chen Zhongjin wrote:
> > KASAN reported a null-ptr-deref error:
> >
> > KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
> > CPU: 0 PID: 1373 Comm: modprobe
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
> > RIP: 0010:dmi_sysfs_entry_release
> > ...
> > Call Trace:
> >   <TASK>
> >   kobject_put
> >   dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs
> >   dmi_decode_table (drivers/firmware/dmi_scan.c:133)
> >   dmi_walk (drivers/firmware/dmi_scan.c:1115)
> >   dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs
> >   do_one_initcall (init/main.c:1296)
> >   ...
> > Kernel panic - not syncing: Fatal exception
> > Kernel Offset: 0x4000000 from 0xffffffff81000000
> > ---[ end Kernel panic - not syncing: Fatal exception ]---
> >
> > It is because previous patch added kobject_put() to release the memory
> > which will call  dmi_sysfs_entry_release() and list_del().
> >
> > However, list_add_tail(entry->list) is called after the error block,
> > so the list_head is uninitialized and cannot be deleted.
> >
> > Move error handling to after list_add_tail to fix this.
> >
> > Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle")
> > Signed-off-by: Chen Zhongjin <chenzhongjin@xxxxxxxxxx>
> > ---
> > v1 -> v2:
> > Change fix to moving error handling to after list_add_tail.
> > So that it is consistent with kobject_put(&entry->kobj) in other
> > places.
> <snip>
>
> I got 2 copies of this, which one is correct?

Sorry I accidentally re-sent this, they are all same.

Thanks!

Chen

> thanks,
>
> greg k-h