linux-kernel - NULL pointer dereference in iio_buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120708115331.GA16281@localhost>
Date:	Sun, 8 Jul 2012 19:53:31 +0800
From:	Fengguang Wu <fengguang.wu@...el.com>
To:	Jonathan Cameron <jic23@...nel.org>
Cc:	Greg Kroah-Hartman <gregkh@...e.de>
Subject: NULL pointer dereference in iio_buffer_register()

Hi Jonathan,

I got this boot error when testing kernel in kvm, built with the attached config:

[    7.618723] kobject: 'tpci200' (ffff8800072f8798): kobject_add_internal: parent: 'drivers', set: 'drivers'
[    7.620602] kobject: 'tpci200' (ffff8800072f8798): kobject_uevent_env
[    7.621875] kobject: 'tpci200' (ffff8800072f8798): fill_kobj_path: path = '/bus/pci/drivers/tpci200'
[    7.623739] BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
[    7.625237] IP: [<ffffffff815071e7>] iio_buffer_register+0x27/0x4b0
[    7.626396] PGD 0 
[    7.626839] Oops: 0000 [#1] PREEMPT SMP 
[    7.627591] CPU 1 
[    7.628027] Pid: 1, comm: swapper/0 Not tainted 3.5.0-rc5+ #36  
[    7.629191] RIP: 0010:[<ffffffff815071e7>]  [<ffffffff815071e7>] iio_buffer_register+0x27/0x4b0
[    7.630569] RSP: 0018:ffff88000008de30  EFLAGS: 00010202
[    7.630569] RAX: ffff8800072f8c58 RBX: 0000000000000000 RCX: 0000000000000000
[    7.630569] RDX: 0000000000000005 RSI: ffffffff81c2b580 RDI: ffff8800072f9008
[    7.630569] RBP: ffff88000008dea0 R08: 0000000000003a84 R09: 000000000000fffe
[    7.630569] R10: 000000000000000a R11: 0000000000000001 R12: ffff8800072f9008
[    7.630569] R13: 0000000000000134 R14: 0000000000000000 R15: ffff8800072f9008
[    7.630569] FS:  0000000000000000(0000) GS:ffff88000de00000(0000) knlGS:0000000000000000
[    7.630569] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[    7.630569] CR2: 00000000000000b0 CR3: 0000000001a0b000 CR4: 00000000000006e0
[    7.630569] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    7.630569] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[    7.630569] Process swapper/0 (pid: 1, threadinfo ffff88000008c000, task ffff88000008a000)
[    7.630569] Stack:
[    7.630569]  ffffffff81e7f3ba 0000000000000000 ffff88000008de70 ffffffff810ac628
[    7.630569]  ffff88000008de80 ffff8800072f95e8 ffffffff818d425b ffffffff81c2b580
[    7.630569]  ffff88000008dea0 0000000000000000 ffff8800072f9008 0000000000000134
[    7.630569] Call Trace:
[    7.630569]  [<ffffffff81e7f3ba>] ? tpci200_drvr_init_module+0x29/0x29
[    7.630569]  [<ffffffff810ac628>] ? debug_mutex_init+0x48/0x70
[    7.630569]  [<ffffffff81e7f3ba>] ? tpci200_drvr_init_module+0x29/0x29
[    7.630569]  [<ffffffff81e7f51d>] iio_dummy_init+0x163/0x1ed
[    7.630569]  [<ffffffff81e49138>] do_one_initcall+0xb6/0x1c8
[    7.630569]  [<ffffffff81e49456>] kernel_init+0x20c/0x2fd
[    7.630569]  [<ffffffff81e48634>] ? loglevel+0x46/0x46
[    7.630569]  [<ffffffff815b32a4>] kernel_thread_helper+0x4/0x10
[    7.630569]  [<ffffffff81e4924a>] ? do_one_initcall+0x1c8/0x1c8
[    7.630569]  [<ffffffff815b32a0>] ? gs_change+0x13/0x13
[    7.630569] Code: 00 00 00 00 55 48 89 e5 41 57 49 89 ff 41 56 41 55 41 54 53 48 83 ec 48 4c 8b b7 f8 02 00 00 48 83 05 9d 13 30 01 01 48 89 75 c8 <49> 8b 86 b0 00 00 00 48 85 c0 74 22 8b 8f 78 05 00 00 48 63 f1 
[    7.630569] RIP  [<ffffffff815071e7>] iio_buffer_register+0x27/0x4b0
[    7.630569]  RSP <ffff88000008de30>
[    7.630569] CR2: 00000000000000b0
[    7.671281] ---[ end trace 2659a79bb8841e3c ]---
[    7.672239] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009

Thanks,
Fengguang

View attachment "config-3.5.0-rc5+" of type "text/plain" (54377 bytes)