kernel: fix possible mtd NULL pointer dereference

Fixes: 1a9ee367343ed ("kernel: backport mtd dynamic partition patch")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

diff --git a/target/linux/generic/backport-5.10/415-v6.0-mtd-core-check-partition-before-dereference.patch b/target/linux/generic/backport-5.10/415-v6.0-mtd-core-check-partition-before-dereference.patch
new file mode 100644 (file)
index 0000000..65789dd
--- /dev/null
+++ b/target/linux/generic/backport-5.10/415-v6.0-mtd-core-check-partition-before-dereference.patch
@@ -0,0 +1,30 @@
+From 7ec4cdb321738d44ae5d405e7b6ac73dfbf99caa Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Mon, 25 Jul 2022 22:49:25 +0900
+Subject: [PATCH] mtd: core: check partition before dereference
+
+syzbot is reporting NULL pointer dereference at mtd_check_of_node() [1],
+for mtdram test device (CONFIG_MTD_MTDRAM) is not partition.
+
+Link: https://syzkaller.appspot.com/bug?extid=fe013f55a2814a9e8cfd [1]
+Reported-by: syzbot <syzbot+fe013f55a2814a9e8cfd@syzkaller.appspotmail.com>
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Fixes: ad9b10d1eaada169 ("mtd: core: introduce of support for dynamic partitions")
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+CC: stable@vger.kernel.org
+Signed-off-by: Richard Weinberger <richard@nod.at>
+---
+ drivers/mtd/mtdcore.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -574,6 +574,8 @@ static void mtd_check_of_node(struct mtd
+               return;
+ 
+       /* Check if a partitions node exist */
++      if (!mtd_is_partition(mtd))
++              return;
+       parent = mtd->parent;
+       parent_dn = dev_of_node(&parent->dev);
+       if (!parent_dn)

diff --git a/target/linux/generic/backport-5.15/404-v6.0-mtd-core-check-partition-before-dereference.patch b/target/linux/generic/backport-5.15/404-v6.0-mtd-core-check-partition-before-dereference.patch
new file mode 100644 (file)
index 0000000..e45e2ab
--- /dev/null
+++ b/target/linux/generic/backport-5.15/404-v6.0-mtd-core-check-partition-before-dereference.patch
@@ -0,0 +1,30 @@
+From 7ec4cdb321738d44ae5d405e7b6ac73dfbf99caa Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Mon, 25 Jul 2022 22:49:25 +0900
+Subject: [PATCH] mtd: core: check partition before dereference
+
+syzbot is reporting NULL pointer dereference at mtd_check_of_node() [1],
+for mtdram test device (CONFIG_MTD_MTDRAM) is not partition.
+
+Link: https://syzkaller.appspot.com/bug?extid=fe013f55a2814a9e8cfd [1]
+Reported-by: syzbot <syzbot+fe013f55a2814a9e8cfd@syzkaller.appspotmail.com>
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Fixes: ad9b10d1eaada169 ("mtd: core: introduce of support for dynamic partitions")
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+CC: stable@vger.kernel.org
+Signed-off-by: Richard Weinberger <richard@nod.at>
+---
+ drivers/mtd/mtdcore.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -577,6 +577,8 @@ static void mtd_check_of_node(struct mtd
+               return;
+ 
+       /* Check if a partitions node exist */
++      if (!mtd_is_partition(mtd))
++              return;
+       parent = mtd->parent;
+       parent_dn = dev_of_node(&parent->dev);
+       if (!parent_dn)

diff --git a/target/linux/generic/hack-5.10/402-mtd-blktrans-call-add-disks-after-mtd-device.patch b/target/linux/generic/hack-5.10/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
index 7de27fddb13ae0c8eec00d2de2713d0af3cd75b8..55388aa40c453a5701693aed818bb03d99902eec 100644 (file)
--- a/target/linux/generic/hack-5.10/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
+++ b/target/linux/generic/hack-5.10/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
@@ -77,7 +77,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  #include "mtdcore.h"
  
-@@ -922,6 +923,8 @@ int mtd_device_parse_register(struct mtd
+@@ -924,6 +925,8 @@ int mtd_device_parse_register(struct mtd
                register_reboot_notifier(&mtd->reboot_notifier);
        }
  

diff --git a/target/linux/generic/hack-5.10/410-block-fit-partition-parser.patch b/target/linux/generic/hack-5.10/410-block-fit-partition-parser.patch
index 00c8d255fca73cf64a83c149335d0280fdc4b872..405cc9d0d439226adc3608564fe9243eedd5e86e 100644 (file)
--- a/target/linux/generic/hack-5.10/410-block-fit-partition-parser.patch
+++ b/target/linux/generic/hack-5.10/410-block-fit-partition-parser.patch
@@ -248,3 +248,4 @@ Submitted-by: Daniel Golle <daniel@makrotopia.org>
 +      FIT_PARTITION = 0x2e,           /* U-Boot uImage.FIT */
        SOLARIS_X86_PARTITION = 0x82,   /* also Linux swap partitions */
        NEW_SOLARIS_X86_PARTITION = 0xbf,
+ 

diff --git a/target/linux/generic/hack-5.10/420-mtd-set-rootfs-to-be-root-dev.patch b/target/linux/generic/hack-5.10/420-mtd-set-rootfs-to-be-root-dev.patch
index ad68d52c729eab6daa1f137bcf0376173e349339..5529bba12c6d3e30b1d80121a7e9dc06d08f4b43 100644 (file)
--- a/target/linux/generic/hack-5.10/420-mtd-set-rootfs-to-be-root-dev.patch
+++ b/target/linux/generic/hack-5.10/420-mtd-set-rootfs-to-be-root-dev.patch
@@ -20,7 +20,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  #include <linux/nvmem-provider.h>
  
  #include <linux/mtd/mtd.h>
-@@ -765,6 +766,19 @@ int add_mtd_device(struct mtd_info *mtd)
+@@ -767,6 +768,19 @@ int add_mtd_device(struct mtd_info *mtd)
           of this try_ nonsense, and no bitching about it
           either. :) */
        __module_get(THIS_MODULE);

diff --git a/target/linux/generic/hack-5.15/402-mtd-blktrans-call-add-disks-after-mtd-device.patch b/target/linux/generic/hack-5.15/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
index 011f790fa7e6067880b05782de47d6e91a80890d..eaba093376c96d2b060760dde49eac83f2dbc13d 100644 (file)
--- a/target/linux/generic/hack-5.15/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
+++ b/target/linux/generic/hack-5.15/402-mtd-blktrans-call-add-disks-after-mtd-device.patch
@@ -77,7 +77,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  #include "mtdcore.h"
  
-@@ -1073,6 +1074,8 @@ int mtd_device_parse_register(struct mtd
+@@ -1075,6 +1076,8 @@ int mtd_device_parse_register(struct mtd
  
        ret = mtd_otp_nvmem_add(mtd);
  

diff --git a/target/linux/generic/hack-5.15/420-mtd-set-rootfs-to-be-root-dev.patch b/target/linux/generic/hack-5.15/420-mtd-set-rootfs-to-be-root-dev.patch
index 90254c63bfbc44baf57f67c8cedf9ca1f8da8260..8bf8288bbd9ed1351c45b3f6906253f683606dc9 100644 (file)
--- a/target/linux/generic/hack-5.15/420-mtd-set-rootfs-to-be-root-dev.patch
+++ b/target/linux/generic/hack-5.15/420-mtd-set-rootfs-to-be-root-dev.patch
@@ -20,7 +20,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  #include <linux/nvmem-provider.h>
  
  #include <linux/mtd/mtd.h>
-@@ -768,6 +769,16 @@ int add_mtd_device(struct mtd_info *mtd)
+@@ -770,6 +771,16 @@ int add_mtd_device(struct mtd_info *mtd)
           of this try_ nonsense, and no bitching about it
           either. :) */
        __module_get(THIS_MODULE);