linux-kernel - Re: Revert e0922e5e3ccb78aa0152e93dfbd1755ac39c8582

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <54DF32D2.70105@kernel.org>
Date:	Sat, 14 Feb 2015 11:34:42 +0000
From:	Jonathan Cameron <jic23@...nel.org>
To:	Andrey Smirnov <andrew.smirnov@...il.com>
CC:	Hartmut Knaack <knaack.h@....de>, linux-iio@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: Revert e0922e5e3ccb78aa0152e93dfbd1755ac39c8582

On 12/02/15 20:23, Andrey Smirnov wrote:
> Hi Jonathan,
> 
> Please revert patch e0922e5e3ccb78aa0152e93dfbd1755ac39c8582:
> 
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/drivers/iio/humidity/si7020.c?id=e0922e5e3ccb78aa0152e93dfbd1755ac39c8582
> 
> It incorrectly assumes that the level of indirection is not needed
> which is not true(probably because the driver incorrectly allocates
> sizeof(*client) instead of sizeof(*data) via devm_iio_device_alloc).
> If you look at the code of the probe function(see below) it is easy to
> see that what is being stored in the private memory of the IIO device
> instance is not a copy of a 'struct i2c_client' but a pointer to an
> instance passed as an argument to the probe function.
> 
> struct i2c_client **data;
> int ret;
> 
> < Some code skipped >
> 
> indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*client));
> if (!indio_dev)
> return -ENOMEM;
> 
> data = iio_priv(indio_dev);
> *data = client;
> 
> Without reverting this change any read of a raw value of this sensor
> leads to a kernel oops due to a NULL pointer de-reference on my
> hardware setup.
> 
> I will be sending a patch to fix the 'sizeof' mixup shortly.
> 
> Thank you,
> Andrey Smirnov
> 
Reverted in the fixes-togreg branch and cc'd to stable.

I'll pick up the fix as well in a minute.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/