linux-kernel - NULL dereference BUG in sch56xx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 9 Aug 2012 20:55:26 +0800
From:	Fengguang Wu <fengguang.wu@...el.com>
To:	Guenter Roeck <linux@...ck-us.net>
Cc:	Jean Delvare <khali@...ux-fr.org>, lm-sensors@...sensors.org,
	linux-kernel@...r.kernel.org
Subject: NULL dereference BUG in sch56xx_init()

Hi Guenter,

This commit triggered an oops which can be fixed by the attached diff.
Should it be folded into the original one (preferable for me), or be
resent as a standalone patch?

tree:   git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git hwmon-staging
head:   a99fac8ea326a5c3b966f558d0b9af309ef31365
commit: 1645e4fc39931604f7a90cdad311bc48e5b92d60 [2/49] hwmon: (sch56xx-common) Fix build warnings

[    4.343014] BUG: unable to handle kernel NULL pointer dereference at           (null)
[    4.344009] IP: [<ffffffff811c6240>] strim+0x80/0x80
[    4.344009] PGD 0 
[    4.344009] Oops: 0000 [#1] 
[    4.344009] CPU 0 
[    4.344009] Pid: 1, comm: swapper Not tainted 3.6.0-rc1-00002-g1645e4f #229 Bochs Bochs
[    4.344009] RIP: 0010:[<ffffffff811c6240>]  [<ffffffff811c6240>] strim+0x80/0x80
[    4.344009] RSP: 0018:ffff880000025e48  EFLAGS: 00010246
[    4.344009] RAX: 000000000000fff6 RBX: 0000000000000000 RCX: 0000000000000000
[    4.344009] RDX: 0000000000000000 RSI: 000000000000ffed RDI: 0000000000000000
[    4.344009] RBP: ffff880000025e70 R08: 0000000000000000 R09: 0000000000000000
[    4.344009] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[    4.344009] R13: 0000000000000000 R14: 000000000000ffed R15: 0000000000000000
[    4.344009] FS:  0000000000000000(0000) GS:ffffffff81a25000(0000) knlGS:0000000000000000
[    4.344009] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[    4.344009] CR2: 0000000000000000 CR3: 0000000001a0f000 CR4: 00000000000006b0
[    4.344009] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    4.344009] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[    4.344009] Process swapper (pid: 1, threadinfo ffff880000024000, task ffff880000028000)
[    4.344009] Stack:
[    4.344009]  ffffffff812c3136 0000000000000000 00000000ffffffed 0000000000000172
[    4.344009]  ffffffff81cf66e0 ffff880000025ed0 ffffffff81cf6805 0000000000000000
[    4.344009]  000000000000ffed 000000000000fff6 0000000000000000 0000000000000100
[    4.344009] Call Trace:
[    4.344009]  [<ffffffff812c3136>] ? platform_device_alloc+0x26/0x90
[    4.344009]  [<ffffffff81cf66e0>] ? pcf8591_init+0x37/0x37
[    4.344009]  [<ffffffff81cf6805>] sch56xx_init+0x125/0x19d
[    4.344009]  [<ffffffff81cccbcc>] do_one_initcall+0x78/0x136
[    4.344009]  [<ffffffff81cccd7b>] kernel_init+0xf1/0x175
[    4.344009]  [<ffffffff81ccc4f7>] ? loglevel+0x31/0x31
[    4.344009]  [<ffffffff81479b04>] kernel_thread_helper+0x4/0x10
[    4.344009]  [<ffffffff814783ec>] ? retint_restore_args+0x13/0x13
[    4.344009]  [<ffffffff81cccc8a>] ? do_one_initcall+0x136/0x136
[    4.344009]  [<ffffffff81479b00>] ? gs_change+0x13/0x13
[    4.344009] Code: 20 74 18 0f 1f 84 00 00 00 00 00 48 83 c0 01 0f b6 10 f6 82 60 07 6b 81 20 75 f0 5d c3 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 <80> 3f 00 55 48 89 e5 74 15 48 89 f8 0f 1f 40 00 48 83 c0 01 80 
[    4.344009] RIP  [<ffffffff811c6240>] strim+0x80/0x80
[    4.344009]  RSP <ffff880000025e48>
[    4.344009] CR2: 0000000000000000

Thanks,
Fengguang

View attachment "dmesg-kvm-waimea-4865-2012-08-09-05-44-13-3.6.0-rc1-00002-g1645e4f-229" of type "text/plain" (117870 bytes)

View attachment "config-3.6.0-rc1-00002-g1645e4f" of type "text/plain" (54127 bytes)

View attachment "sch56xx_init-NULL-fix" of type "text/plain" (615 bytes)