linux-kernel - Re: [PATCH] hwmon: (w83627ehf): fix broken driver init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 5 Nov 2011 07:38:01 -0700
From:	Guenter Roeck <guenter.roeck@...csson.com>
To:	Jean Delvare <khali@...ux-fr.org>
CC:	Alexander Beregalov <a.beregalov@...il.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"stable@...nel.org" <stable@...nel.org>
Subject: Re: [PATCH] hwmon: (w83627ehf): fix broken driver init

On Sat, Nov 05, 2011 at 04:13:51AM -0400, Jean Delvare wrote:
> Hi Alexander, Guenter,
> 
> On Fri, 4 Nov 2011 21:51:56 -0700, Guenter Roeck wrote:
> > On Fri, Nov 04, 2011 at 08:54:10PM -0400, Alexander Beregalov wrote:
> > > Commit 2265cef2 (hwmon: (w83627ehf) Properly report PECI and AMD-SI
> > > sensor types) results in kernel panic if data->temp_label was not
> > > initialized.
> > > The problem was found with chip W83627DHG-P.
> > > 
> > > backtrace:
> > > page_fault()
> > > w83627ehf_probe() 0x8e2
> > > 
> > > w83627ehf_init_device:
> > > 1837:	for (i = 0; i < 3; i++) {
> > > 		const char *label = data->temp_label[data->temp_src[i]];
> > > 
> > > 		/* Digital source overrides analog type */
> > > 		if (strncmp(label, "PECI", 4) == 0)
> > > 			data->temp_type[i] = 6;
> > > 
> > > 	movzbl	128(%r14), %edx	# data->temp_src, tmp737
> > > 	movq	144(%r13), %rax	# data_32->temp_label, data_32->temp_label
> > > 	movq	$.LC18, %rsi	#,
> > > 	movl	%r14d, %r15d	#, i
> > > 	subl	%r13d, %r15d	# D.29277, i
> > > 0x928	movq	(%rax,%rdx,8), %rcx	#* data_32->temp_label, label
> > > 	movl	$4, %edx	#,
> > > 	movq	%rcx, %rdi	# label,
> > > 	movq	%rcx, -96(%rbp)	#,
> > > 	call	strncmp	#
> > > 
> > > page_fault() is called at 0x928 (0x8e2+0x46).
> 
> Oops, my bad. I forgot that not all chips have temperature labels,
> sorry :( Thanks for reporting so quickly!
> 
> > > 
> > > Add check if data->temp->label was set before use.
> > > 
> > > Cc: Jean Delvare <khali@...ux-fr.org>
> > > Cc: Guenter Roeck <guenter.roeck@...csson.com>
> > > Cc: stable@...nel.org
> > > Signed-off-by: Alexander Beregalov <a.beregalov@...il.com>
> > > ---
> > >  drivers/hwmon/w83627ehf.c |   17 +++++++++--------
> > >  1 files changed, 9 insertions(+), 8 deletions(-)
> > > 
> > > diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
> > > index 483cb26..70f1c73 100644
> > > --- a/drivers/hwmon/w83627ehf.c
> > > +++ b/drivers/hwmon/w83627ehf.c
> > > @@ -1835,14 +1835,15 @@ static inline void __devinit w83627ehf_init_device(struct w83627ehf_data *data,
> > >  		diode = 0x70;
> > >  	}
> > >  	for (i = 0; i < 3; i++) {
> > > -		const char *label = data->temp_label[data->temp_src[i]];
> > > -
> > > -		/* Digital source overrides analog type */
> > > -		if (strncmp(label, "PECI", 4) == 0)
> > > -			data->temp_type[i] = 6;
> > > -		else if (strncmp(label, "AMD", 3) == 0)
> > > -			data->temp_type[i] = 5;
> > > -		else if ((tmp & (0x02 << i)))
> > > +		if (data->temp_label) {
> > > +			const char *label = data->temp_label[data->temp_src[i]];
> > > +
> > > +			/* Digital source overrides analog type */
> > > +			if (strncmp(label, "PECI", 4) == 0)
> > > +				data->temp_type[i] = 6;
> > > +			else if (strncmp(label, "AMD", 3) == 0)
> > > +				data->temp_type[i] = 5;
> > > +		} else if ((tmp & (0x02 << i)))
> > 
> > Followup - something like
> > 		const char *label = NULL;
> > 
> > 		if (data->temp_label)
> > 			label = data->temp_label[data->temp_src[i]];
> > 
> > 		/* Digital source overrides analog type */
> > 		if (label && strncmp(label, "PECI", 4) == 0)
> > 			data->temp_type[i] = 6;
> > 		else if (label && strncmp(label, "AMD", 3) == 0)
> > 			data->temp_type[i] = 5;
> > 		else if ((tmp & (0x02 << i)))
> > 
> > should do it. I am open to better ideas...
> 
> Looks good enough to me, this is one-time initialization code, it
> doesn't need to be lightning fast. Will you send a formal patch, or do
> you want me to do it?
> 
I'll send one in a minute.

Guenter
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/