misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()

In the function bcm_vk_read(), the pointer entry is checked, indicating
that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
following code may cause null-pointer dereferences:

  struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
  set_msg_id(&tmp_msg, entry->usr_msg_id);
  tmp_msg.size = entry->to_h_blks - 1;

To prevent these possible null-pointer dereferences, copy to_h_msg,
usr_msg_id, and to_h_blks from iter into temporary variables, and return
these temporary variables to the application instead of accessing them
through a potentially NULL entry.

Signed-off-by: Tuo Li <islituo@gmail.com>
Reviewed-by: Scott Branden <scott.branden@broadcom.com>
Link: https://patch.msgid.link/20251211063637.3987937-1-islituo@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/misc/bcm-vk/bcm_vk_msg.c b/drivers/misc/bcm-vk/bcm_vk_msg.c
index 1f42d1d5a630a23734878fe6a4414cdb14495849..665a3888708ac7f2615d85d0b9242b457b48e278 100644 (file)
--- a/drivers/misc/bcm-vk/bcm_vk_msg.c
+++ b/drivers/misc/bcm-vk/bcm_vk_msg.c
@@ -1010,6 +1010,9 @@ ssize_t bcm_vk_read(struct file *p_file,
        struct device *dev = &vk->pdev->dev;
        struct bcm_vk_msg_chan *chan = &vk->to_h_msg_chan;
        struct bcm_vk_wkent *entry = NULL, *iter;
+       struct vk_msg_blk tmp_msg;
+       u32 tmp_usr_msg_id;
+       u32 tmp_blks;
        u32 q_num;
        u32 rsp_length;
 
@@ -1034,6 +1037,9 @@ ssize_t bcm_vk_read(struct file *p_file,
                                        entry = iter;
                                } else {
                                        /* buffer not big enough */
+                                       tmp_msg = iter->to_h_msg[0];
+                                       tmp_usr_msg_id = iter->usr_msg_id;
+                                       tmp_blks = iter->to_h_blks;
                                        rc = -EMSGSIZE;
                                }
                                goto read_loop_exit;
@@ -1052,14 +1058,12 @@ read_loop_exit:
 
                bcm_vk_free_wkent(dev, entry);
        } else if (rc == -EMSGSIZE) {
-               struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
-
                /*
                 * in this case, return just the first block, so
                 * that app knows what size it is looking for.
                 */
-               set_msg_id(&tmp_msg, entry->usr_msg_id);
-               tmp_msg.size = entry->to_h_blks - 1;
+               set_msg_id(&tmp_msg, tmp_usr_msg_id);
+               tmp_msg.size = tmp_blks - 1;
                if (copy_to_user(buf, &tmp_msg, VK_MSGQ_BLK_SIZE) != 0) {
                        dev_err(dev, "Error return 1st block in -EMSGSIZE\n");
                        rc = -EFAULT;