On Tue, Nov 05, 2024 at 08:20:22AM +0800, Zijun Hu wrote:
From: Zijun Hu quic_zijuhu@quicinc.com
class_dev_iter_init(struct class_dev_iter *iter, struct class *class, ...) has return type void, but it does not initialize its output parameter @iter when suffers class_to_subsys(@class) error, so caller can not detect the error and call API class_dev_iter_next(@iter) which will dereference wild pointers of @iter's members as shown by below typical usage:
// @iter's members are wild pointers struct class_dev_iter iter;
// No change in @iter when the error happens. class_dev_iter_init(&iter, ...);
// dereference these wild member pointers here. while (dev = class_dev_iter_next(&iter)) { ... }.
Actually, all callers of the API have such usage pattern in kernel tree. Fix by memset() @iter in API *_init() and error checking @iter in *_next().
Fixes: 7b884b7f24b4 ("driver core: class.c: convert to only use class_to_subsys") Cc: stable@vger.kernel.org
There is no in-kernel broken users of this from what I can tell, right? Otherwise things would have blown up by now, so why is this needed in stable kernels?
thanks,
greg k-h