linux-kernel - Re: [PATCH] hwmon (ina2xx) Fix NULL id pointer in probe()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 9 Nov 2018 18:04:41 -0800
From:   Guenter Roeck <linux@...ck-us.net>
To:     Nicolin Chen <nicoleotsuka@...il.com>
Cc:     jdelvare@...e.com, linux-hwmon@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] hwmon (ina2xx) Fix NULL id pointer in probe()

On Fri, Nov 09, 2018 at 04:42:14PM -0800, Nicolin Chen wrote:
> When using DT configurations, the id pointer might turn out to
> be NULL. Then the driver encounters NULL pointer access:
> 
>   Unable to handle kernel read from unreadable memory at vaddr 00000018
>   [...]
>   PC is at ina2xx_probe+0x114/0x200
>   LR is at ina2xx_probe+0x10c/0x200
>   [...]
>   Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
> 
> The reason is that i2c core returns the id pointer by matching
> id_table with client->name, while the client->name is actually
> using the name from the first string in the DT compatible list,
> not the best one. So i2c core would fail to match the id_table
> if the best matched compatible string isn't the first one, and
> then would return a NULL id pointer.
> 
> This probably should be fixed in i2c core. But it doesn't hurt
> to make the driver robust. So this patch fixes it by using the
> "chip" that's added to unify both DT and non-DT configurations.
> 
> Additionally, since id pointer could be null, so as id->name:
>   ina2xx 10-0047: power monitor (null) (Rshunt = 1000 uOhm)
>   ina2xx 10-0048: power monitor (null) (Rshunt = 10000 uOhm)
> 
> So this patch also fixes NULL name pointer, using client->name
> to play safe and to align with hwmon->name.
> 
> Fixes: bd0ddd4d0883 ("hwmon: (ina2xx) Add OF device ID table")
> Signed-off-by: Nicolin Chen <nicoleotsuka@...il.com>

Applied.

Thanks,
Guenter

> ---
>  drivers/hwmon/ina2xx.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
> index 71d3445ba869..c2252cf452f5 100644
> --- a/drivers/hwmon/ina2xx.c
> +++ b/drivers/hwmon/ina2xx.c
> @@ -491,7 +491,7 @@ static int ina2xx_probe(struct i2c_client *client,
>  	}
>  
>  	data->groups[group++] = &ina2xx_group;
> -	if (id->driver_data == ina226)
> +	if (chip == ina226)
>  		data->groups[group++] = &ina226_group;
>  
>  	hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
> @@ -500,7 +500,7 @@ static int ina2xx_probe(struct i2c_client *client,
>  		return PTR_ERR(hwmon_dev);
>  
>  	dev_info(dev, "power monitor %s (Rshunt = %li uOhm)\n",
> -		 id->name, data->rshunt);
> +		 client->name, data->rshunt);
>  
>  	return 0;
>  }
> -- 
> 2.17.1
>