[PATCH v2] driver: tx2: Add NULL check in tx2_uncore_pmu_register

[PATCH v2] driver: tx2: Add NULL check in tx2_uncore_pmu_register

[Henry Martin]

devm_kasprintf() return NULL if memory allocation fails. Currently,
tx2_uncore_pmu_register() does not check for this case, leading to a
possible NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue.

Fixes: 69c32972d593 ("drivers/perf: Add Cavium ThunderX2 SoC UNCORE PMU driver")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
V1 -> V2: Fix commit message to use imperative mood and wrap lines to 75
characters.

 drivers/perf/thunderx2_pmu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/perf/thunderx2_pmu.c b/drivers/perf/thunderx2_pmu.c
index 6ed4707bd6bb..24443ab5d998 100644
--- a/drivers/perf/thunderx2_pmu.c
+++ b/drivers/perf/thunderx2_pmu.c
@@ -738,7 +738,8 @@ static int tx2_uncore_pmu_register(
 
 	tx2_pmu->pmu.name = devm_kasprintf(dev, GFP_KERNEL,
 			"%s", name);
-
+	if (!tx2_pmu->pmu.name)
+		return -ENOMEM;
 	return perf_pmu_register(&tx2_pmu->pmu, tx2_pmu->pmu.name, -1);
 }
 
-- 
2.34.1

Re: [PATCH v2] driver: tx2: Add NULL check in tx2_uncore_pmu_register

[Markus Elfring]

> devm_kasprintf() return NULL if memory allocation fails. Currently,

                   call returns?                    failed?


> tx2_uncore_pmu_register() does not check for this case, leading to a
> possible NULL pointer dereference.
…

You may omit the word “possible” in such a change description.


Is any automated source code analysis involved here?
https://cwe.mitre.org/data/definitions/252.html

Regards,
Markus

Re: [PATCH v2] driver: tx2: Add NULL check in tx2_uncore_pmu_register

[Markus Elfring]

…
> +++ b/drivers/perf/thunderx2_pmu.c
> @@ -738,7 +738,8 @@ static int tx2_uncore_pmu_register(
>
>  	tx2_pmu->pmu.name = devm_kasprintf(dev, GFP_KERNEL,
>  			"%s", name);
> -
> +	if (!tx2_pmu->pmu.name)
> +		return -ENOMEM;
>  	return perf_pmu_register(&tx2_pmu->pmu, tx2_pmu->pmu.name, -1);
>  }
…

Should source code analysis approaches take further implementation details
better into account?

Example:
perf_pmu_register()
https://elixir.bootlin.com/linux/v6.14-rc6/source/kernel/events/core.c#L11859-L11862
…
	if (WARN_ONCE(!name, "Can not register anonymous pmu.\n")) {
		ret = -EINVAL;
…


Regards,
Markus