From: Andy Shevchenko andriy.shevchenko@linux.intel.com
[ Upstream commit 993eb48fa199b5f476df8204e652eff63dd19361 ]
If dev_set_name() fails, the dev_name() is null, check the return value of dev_set_name() to avoid the null-ptr-deref.
Fixes: 1413ef638aba ("i2c: dev: Fix the race between the release of i2c_dev and cdev") Signed-off-by: Andy Shevchenko andriy.shevchenko@linux.intel.com Signed-off-by: Wolfram Sang wsa@kernel.org Signed-off-by: Feng Liu Feng.Liu3@windriver.com Signed-off-by: He Zhe Zhe.He@windriver.com
--- Verified the build test. --- drivers/i2c/i2c-dev.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c index dafad891998e..f0bd4ae19df6 100644 --- a/drivers/i2c/i2c-dev.c +++ b/drivers/i2c/i2c-dev.c @@ -669,17 +669,22 @@ static int i2cdev_attach_adapter(struct device *dev, void *dummy) i2c_dev->dev.class = i2c_dev_class; i2c_dev->dev.parent = &adap->dev; i2c_dev->dev.release = i2cdev_dev_release; - dev_set_name(&i2c_dev->dev, "i2c-%d", adap->nr); + + res = dev_set_name(&i2c_dev->dev, "i2c-%d", adap->nr); + if (res) + goto err_put_i2c_dev;
res = cdev_device_add(&i2c_dev->cdev, &i2c_dev->dev); - if (res) { - put_i2c_dev(i2c_dev, false); - return res; - } + if (res) + goto err_put_i2c_dev;
pr_debug("i2c-dev: adapter [%s] registered as minor %d\n", adap->name, adap->nr); return 0; + +err_put_i2c_dev: + put_i2c_dev(i2c_dev, false); + return res; }
static int i2cdev_detach_adapter(struct device *dev, void *dummy)
[ Sasha's backport helper bot ]
Hi,
✅ All tests passed successfully. No issues detected. No action required from the submitter.
The upstream commit SHA1 provided is correct: 993eb48fa199b5f476df8204e652eff63dd19361
WARNING: Author mismatch between patch and upstream commit: Backport author: Feng LiuFeng.Liu3@windriver.com Commit author: Andy Shevchenkoandriy.shevchenko@linux.intel.com
Status in newer kernel trees: 6.13.y | Present (exact SHA1) 6.12.y | Present (exact SHA1) 6.6.y | Present (exact SHA1) 6.1.y | Present (exact SHA1) 5.15.y | Present (different SHA1: 2f345bb14ad4)
Note: The patch differs from the upstream commit: --- 1: 993eb48fa199b ! 1: 011fada4599a5 i2c: dev: check return value when calling dev_set_name() @@ Metadata ## Commit message ## i2c: dev: check return value when calling dev_set_name()
+ [ Upstream commit 993eb48fa199b5f476df8204e652eff63dd19361 ] + If dev_set_name() fails, the dev_name() is null, check the return value of dev_set_name() to avoid the null-ptr-deref.
Fixes: 1413ef638aba ("i2c: dev: Fix the race between the release of i2c_dev and cdev") Signed-off-by: Andy Shevchenko andriy.shevchenko@linux.intel.com Signed-off-by: Wolfram Sang wsa@kernel.org + Signed-off-by: Feng Liu Feng.Liu3@windriver.com + Signed-off-by: He Zhe Zhe.He@windriver.com
## drivers/i2c/i2c-dev.c ## @@ drivers/i2c/i2c-dev.c: static int i2cdev_attach_adapter(struct device *dev, void *dummy) @@ drivers/i2c/i2c-dev.c: static int i2cdev_attach_adapter(struct device *dev, void + if (res) + goto err_put_i2c_dev;
- pr_debug("adapter [%s] registered as minor %d\n", adap->name, adap->nr); + pr_debug("i2c-dev: adapter [%s] registered as minor %d\n", + adap->name, adap->nr); return 0; + +err_put_i2c_dev: ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.10.y | Success | Success |
linux-stable-mirror@lists.linaro.org
-
Feng Liu -
Sasha Levin