• Wang Hai's avatar
    ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators() · 776c7501
    Wang Hai authored
    I got a null-ptr-deref report:
    
    KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
    ...
    RIP: 0010:regulator_enable+0x84/0x260
    ...
    Call Trace:
     ahci_platform_enable_regulators+0xae/0x320
     ahci_platform_enable_resources+0x1a/0x120
     ahci_probe+0x4f/0x1b9
     platform_probe+0x10b/0x280
    ...
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    If devm_regulator_get() in ahci_platform_get_resources() fails,
    hpriv->phy_regulator will point to NULL, when enabling or disabling it,
    null-ptr-deref will occur.
    
    ahci_probe()
    	ahci_platform_get_resources()
    		devm_regulator_get(, "phy") // failed, let phy_regulator = NULL
    	ahci_platform_enable_resources()
    		ahci_platform_enable_regulators()
    			regulator_enable(hpriv->phy_regulator) // null-ptr-deref
    
    commit 962399bb ("ata: libahci_platform: Fix regulator_get_optional()
    misuse") replaces devm_regulator_get_optional() with devm_regulator_get(),
    but PHY regulator omits to delete "hpriv->phy_regulator = NULL;" like AHCI.
    Delete it like AHCI regulator to fix this bug.
    
    Fixes: commit 962399bb ("ata: libahci_platform: Fix regulator_get_optional() misuse")
    Reported-by: default avatarHulk Robot <hulkci@huawei.com>
    Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
    Reviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
    Signed-off-by: default avatarDamien Le Moal <damien.lemoal@wdc.com>
    776c7501
libahci_platform.c 20.6 KB