linux-kernel - Re: [PATCH v2] PCI: iproc: Fix NULL pointer dereference for BCMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 12 Jan 2018 18:06:05 +0000
From:   Lorenzo Pieralisi <lorenzo.pieralisi@....com>
To:     Ray Jui <ray.jui@...adcom.com>
Cc:     Bjorn Helgaas <bhelgaas@...gle.com>,
        Bjorn Helgaas <helgaas@...nel.org>,
        linux-kernel@...r.kernel.org,
        bcm-kernel-feedback-list@...adcom.com, linux-pci@...r.kernel.org,
        Rafal Milecki <rafal@...ecki.pl>, stable@...r.kernel.org
Subject: Re: [PATCH v2] PCI: iproc: Fix NULL pointer dereference for BCMA

On Thu, Jan 11, 2018 at 12:36:16PM -0800, Ray Jui wrote:
> With the inbound DMA mapping supported added, the iProc PCIe driver
> parses DT property "dma-ranges" through call to
> "of_pci_dma_range_parser_init". In the case of BCMA, this results in a
> NULL pointer deference due to a missing of_node.
> 
> Fix this by adding a guard in pcie-iproc-platform.c to only enable the
> inbound DMA mapping logic when DT property "dma-ranges" is present
> 
> Fixes: dd9d4e7498de3 ("PCI: iproc: Add inbound DMA mapping support")
> Reported-by: Rafał Miłecki <rafal@...ecki.pl>
> Signed-off-by: Ray Jui <ray.jui@...adcom.com>
> Tested-by: Rafał Miłecki <rafal@...ecki.pl>
> cc: <stable@...r.kernel.org> # 4.10+
> ---
>  drivers/pci/host/pcie-iproc-platform.c | 7 +++++++
>  drivers/pci/host/pcie-iproc.c          | 8 +++++---
>  drivers/pci/host/pcie-iproc.h          | 2 ++
>  3 files changed, 14 insertions(+), 3 deletions(-)

Applied to pci/dwc for 4.16, thanks.

Lorenzo

> diff --git a/drivers/pci/host/pcie-iproc-platform.c b/drivers/pci/host/pcie-iproc-platform.c
> index a5073a9..32228d4 100644
> --- a/drivers/pci/host/pcie-iproc-platform.c
> +++ b/drivers/pci/host/pcie-iproc-platform.c
> @@ -92,6 +92,13 @@ static int iproc_pcie_pltfm_probe(struct platform_device *pdev)
>  		pcie->need_ob_cfg = true;
>  	}
>  
> +	/*
> +	 * DT nodes are not used by all platforms that use the iProc PCIe
> +	 * core driver. For platforms that require explict inbound mapping
> +	 * configuration, "dma-ranges" would have been present in DT
> +	 */
> +	pcie->need_ib_cfg = of_property_read_bool(np, "dma-ranges");
> +
>  	/* PHY use is optional */
>  	pcie->phy = devm_phy_get(dev, "pcie-phy");
>  	if (IS_ERR(pcie->phy)) {
> diff --git a/drivers/pci/host/pcie-iproc.c b/drivers/pci/host/pcie-iproc.c
> index 935909b..7583606 100644
> --- a/drivers/pci/host/pcie-iproc.c
> +++ b/drivers/pci/host/pcie-iproc.c
> @@ -1378,9 +1378,11 @@ int iproc_pcie_setup(struct iproc_pcie *pcie, struct list_head *res)
>  		}
>  	}
>  
> -	ret = iproc_pcie_map_dma_ranges(pcie);
> -	if (ret && ret != -ENOENT)
> -		goto err_power_off_phy;
> +	if (pcie->need_ib_cfg) {
> +		ret = iproc_pcie_map_dma_ranges(pcie);
> +		if (ret && ret != -ENOENT)
> +			goto err_power_off_phy;
> +	}
>  
>  #ifdef CONFIG_ARM
>  	pcie->sysdata.private_data = pcie;
> diff --git a/drivers/pci/host/pcie-iproc.h b/drivers/pci/host/pcie-iproc.h
> index a6b55ce..4ac6282 100644
> --- a/drivers/pci/host/pcie-iproc.h
> +++ b/drivers/pci/host/pcie-iproc.h
> @@ -74,6 +74,7 @@ struct iproc_msi;
>   * @ob: outbound mapping related parameters
>   * @ob_map: outbound mapping related parameters specific to the controller
>   *
> + * @need_ib_cfg: indicates SW needs to configure the inbound mapping window
>   * @ib: inbound mapping related parameters
>   * @ib_map: outbound mapping region related parameters
>   *
> @@ -101,6 +102,7 @@ struct iproc_pcie {
>  	struct iproc_pcie_ob ob;
>  	const struct iproc_pcie_ob_map *ob_map;
>  
> +	bool need_ib_cfg;
>  	struct iproc_pcie_ib ib;
>  	const struct iproc_pcie_ib_map *ib_map;
>  
> -- 
> 2.1.4
>