CVE-2024-35943: Add .vulnerable file
The issue fixed by commit 5d7f58ee08434a33340f75ac7ac5071eea9673b3
addresses a missing NULL pointer check after a devm_kasprintf() call
that could lead to a kernel crash or undefined behavior.
Commit 58cbff023bfaeb by Tony Lindgren on 2020-07-02 introduced the
root cause of this issue. This commit added basic power domain support
to the OMAP PRM (Power and Reset Manager) driver.
In the omap_prm_domain_init() function, the original code introduced:
name = devm_kasprintf(dev, GFP_KERNEL, "prm_%s", data->name);
// No NULL check here\!
prmd->pd.name = name; // Assigns potentially NULL pointer
// ...
pm_genpd_init(&prmd->pd, NULL, true); // Uses pd.name internally
The chain of events leading to potential failure:
1. Memory Allocation Failure: devm_kasprintf() calls devm_kmalloc()
internally to allocate memory. If the system is under memory
pressure, this allocation can fail and return NULL.
2. NULL Assignment: Without checking the return value, the code assigns
this potentially NULL pointer to prmd->pd.name.
3. Unsafe Usage in pm_genpd_init(): The pm_genpd_init() function uses
genpd->name in two critical places:
- For warning messages: pr_warn("%s: no governor for states\n",
genpd->name);
- For setting the device name: dev_set_name(&genpd->dev, "%s",
genpd->name);
4. Kernel Crash Scenario: When dev_set_name() is called with a NULL
name and the device doesn't already have a name, it eventually calls
strchr(NULL, '%') in kvasprintf_const(), causing a NULL pointer
dereference and kernel crash.
The fix in commit 5d7f58ee08434a33340f75ac7ac5071eea9673b3 is simple
but crucial - it adds a check that ensures if memory allocation fails,
the function returns an error instead of proceeding with a NULL pointer
that would cause a crash later.
The root underlying issue was introduced in commit 58cbff023bfaeb
("soc: ti: omap-prm: Add basic power domain support") on 2020-07-02,
where the code failed to check the return value of devm_kasprintf()
before using it, violating a fundamental rule of kernel programming:
always check for allocation failures. This created a potential NULL
pointer dereference path that could crash the kernel under memory
pressure conditions.
Signed-off-by: Sasha Levin <sashal@kernel.org>
1 file changed
