linux-kernel - Re: [PATCH] coresight: access conn->child

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 16 Jun 2016 09:22:07 -0600
From:	Mathieu Poirier <mathieu.poirier@...aro.org>
To:	Sudeep Holla <sudeep.holla@....com>
Cc:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-arm-kernel@...ts.infradead.org" 
	<linux-arm-kernel@...ts.infradead.org>,
	Suzuki K Poulose <suzuki.poulose@....com>
Subject: Re: [PATCH] coresight: access conn->child_name only if it's initialised

On 16 June 2016 at 04:13, Sudeep Holla <sudeep.holla@....com> wrote:
> If the addition of the coresight devices get deferred, then there's a
> window before child_name is populated by of_get_coresight_platform_data
> from the respective component driver's probe and the attempted to access
> the same from coresight_orphan_match resulting in kernel NULL pointer
> dereference as below:
>
> Unable to handle kernel NULL pointer dereference at virtual address 0x0
> Internal error: Oops: 96000004 [#1] PREEMPT SMP
> Modules linked in:
> CPU: 0 PID: 1038 Comm: kworker/0:1 Not tainted 4.7.0-rc3 #124
> Hardware name: ARM Juno development board (r2) (DT)
> Workqueue: events amba_deferred_retry_func
> PC is at strcmp+0x1c/0x160
> LR is at coresight_orphan_match+0x7c/0xd0
> Call trace:
>  strcmp+0x1c/0x160
>  bus_for_each_dev+0x60/0xa0
>  coresight_register+0x264/0x2e0
>  tmc_probe+0x130/0x310
>  amba_probe+0xd4/0x1c8
>  driver_probe_device+0x22c/0x418
>  __device_attach_driver+0xbc/0x158
>  bus_for_each_drv+0x58/0x98
>  __device_attach+0xc4/0x160
>  device_initial_probe+0x10/0x18
>  bus_probe_device+0x94/0xa0
>  device_add+0x344/0x580
>  amba_device_try_add+0x194/0x238
>  amba_deferred_retry_func+0x48/0xd0
>  process_one_work+0x118/0x378
>  worker_thread+0x48/0x498
>  kthread+0xd0/0xe8
>  ret_from_fork+0x10/0x40
>
> This patch adds a check for non-NULL conn->child_name before accessing
> the same.
>
> Cc: Mathieu Poirier <mathieu.poirier@...aro.org>
> Signed-off-by: Sudeep Holla <sudeep.holla@....com>
> ---
>  drivers/hwtracing/coresight/coresight.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
> index 5443d03a1eec..12ca4cd97f5b 100644
> --- a/drivers/hwtracing/coresight/coresight.c
> +++ b/drivers/hwtracing/coresight/coresight.c
> @@ -722,7 +722,8 @@ static int coresight_orphan_match(struct device *dev, void *data)
>                 /* We have found at least one orphan connection */
>                 if (conn->child_dev == NULL) {
>                         /* Does it match this newly added device? */
> -                       if (!strcmp(dev_name(&csdev->dev), conn->child_name)) {
> +                       if (conn->child_name &&
> +                           !strcmp(dev_name(&csdev->dev), conn->child_name)) {
>                                 conn->child_dev = csdev;
>                         } else {
>                                 /* This component still has an orphan */
> --
> 2.7.4
>

Applied - thanks.
Mathieu