linux-kernel - Re: [RFT v2] pinctrl: samsung: Fix NULL pointer exception on external interrupts on S3C24xx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <fcd49f07-04ed-3968-23d8-8e5cba2718df@163.com>
Date:   Sat, 17 Jun 2017 00:59:45 +0800
From:   Lihua Yao <ylhuajnu@....com>
To:     Krzysztof Kozlowski <krzk@...nel.org>,
        Kukjin Kim <kgene@...nel.org>,
        Tomasz Figa <tomasz.figa@...il.com>,
        Sylwester Nawrocki <s.nawrocki@...sung.com>,
        Linus Walleij <linus.walleij@...aro.org>,
        linux-arm-kernel@...ts.infradead.org,
        linux-samsung-soc@...r.kernel.org, linux-gpio@...r.kernel.org,
        linux-kernel@...r.kernel.org
Cc:     Chanwoo Choi <cw00.choi@...sung.com>,
        Marek Szyprowski <m.szyprowski@...sung.com>,
        Sergio Prado <sergio.prado@...abworks.com>,
        Donglin Peng <dolinux.peng@...il.com>, stable@...r.kernel.org
Subject: Re: [RFT v2] pinctrl: samsung: Fix NULL pointer exception on external
 interrupts on S3C24xx

On Thursday, June 15, 2017 11:46 PM, Krzysztof Kozlowski wrote:
> After commit 8b1bd11c1f8f ("pinctrl: samsung: Add the support the
> multiple IORESOURCE_MEM for one pin-bank"), the S3C24xx (and probably
> S3C64xx as well) fails:
>
> 	Unable to handle kernel NULL pointer dereference at virtual address 000000a8
> 	...
> 	(s3c24xx_demux_eint4_7) from [<c004469c>] (__handle_domain_irq+0x6c/0xcc)
> 	(__handle_domain_irq) from [<c0009444>] (s3c24xx_handle_irq+0x6c/0x12c)
> 	(s3c24xx_handle_irq) from [<c000e5fc>] (__irq_svc+0x5c/0x78)
>
> Mentioned commit moved the pointer to controller's base IO memory address
> from each controller's driver data (samsung_pinctrl_drv_data) to per-bank
> structure (samsung_pin_bank).  The external interrupt demux
> handlers (s3c24xx_demux_eint()) tried to get this base address from opaque
> pointer stored under irq_chip data:
>
> 	struct irq_data *irqd = irq_desc_get_irq_data(desc);
> 	struct samsung_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
> 	...
> 	pend = readl(bank->eint_base + EINTPEND_REG);
>
> which is wrong because this is hardware irq and it bank was never set
> for this irq_chip.
>
> For S3C24xx and S3C64xx, this partially reverts mentioned commit by
> bringing back the virt_base stored under each controller's driver data
> (samsung_pinctrl_drv_data).  This virt_base address will be now
> duplicated:
>   - samsung_pinctrl_drv_data->virt_base: used on S3C24xx and S3C64xx,
>   - samsung_pin_bank->pctl_base: used on Exynos.
>
> Fixes: 8b1bd11c1f8f ("pinctrl: samsung: Add the support the multiple IORESOURCE_MEM for one pin-bank")
> Cc: <stable@...r.kernel.org>
> Cc: Sergio Prado <sergio.prado@...abworks.com>
> Reported-by: Sergio Prado <sergio.prado@...abworks.com>
> Signed-off-by: Krzysztof Kozlowski <krzk@...nel.org>
>
> ---
>
> Tested on Odroid XU3.
> Please kindly test on S3C24xx and S3C64xx. Other tests, including
> Exynos5433 are also welcomed.
>
> Changes since v1:
> 1. Fix NULL pointer exception when setting virt_base because bdata
>     pointer is invalid at this point (incremented by loop). Spotted
>     by Yao Lihua.
> ---
Works well for me. Tested on TINY6410 board.

Tested-by: Lihua Yao <ylhuajnu@....com>

Thanks!
Lihua