]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
authorTuo Li <islituo@gmail.com>
Thu, 11 Dec 2025 06:36:37 +0000 (14:36 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 29 Dec 2025 10:55:21 +0000 (11:55 +0100)
commitba75ecb97d3f4e95d59002c13afb6519205be6cb
treed0b1b2da3d4e5a4407b580b74ddd09e7cd7feeaa
parentb54c82d6cbfc76647ba558e8e3647eb2b0ba0e2b
misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()

In the function bcm_vk_read(), the pointer entry is checked, indicating
that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
following code may cause null-pointer dereferences:

  struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
  set_msg_id(&tmp_msg, entry->usr_msg_id);
  tmp_msg.size = entry->to_h_blks - 1;

To prevent these possible null-pointer dereferences, copy to_h_msg,
usr_msg_id, and to_h_blks from iter into temporary variables, and return
these temporary variables to the application instead of accessing them
through a potentially NULL entry.

Signed-off-by: Tuo Li <islituo@gmail.com>
Reviewed-by: Scott Branden <scott.branden@broadcom.com>
Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/bcm-vk/bcm_vk_msg.c