Skip to content

Commit

Permalink
parisc: led: Fix potential null-ptr-deref in start_task()
Browse files Browse the repository at this point in the history
commit 41f563a upstream.

start_task() calls create_singlethread_workqueue() and not checked the
ret value, which may return NULL. And a null-ptr-deref may happen:

start_task()
    create_singlethread_workqueue() # failed, led_wq is NULL
    queue_delayed_work()
        queue_delayed_work_on()
            __queue_delayed_work()  # warning here, but continue
                __queue_work()      # access wq->flags, null-ptr-deref

Check the ret value and return -ENOMEM if it is NULL.

Fixes: 3499495 ("[PARISC] Use work queue in LED/LCD driver instead of tasklet.")
Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Shang XiaoJing authored and gregkh committed Jan 7, 2023
1 parent dc88a50 commit 67c98fe
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions drivers/parisc/led.c
Expand Up @@ -137,6 +137,9 @@ static int start_task(void)

/* Create the work queue and queue the LED task */
led_wq = create_singlethread_workqueue("led_wq");
if (!led_wq)
return -ENOMEM;

queue_delayed_work(led_wq, &led_task, 0);

return 0;
Expand Down

0 comments on commit 67c98fe

Please sign in to comment.