linux-kernel - Re: [PATCH] drm: sun4i: Fix NULL/invalid pointer dereference in sun8i_tcon_top

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190408083110.iy3auc7ggindifbf@flea>
Date:   Mon, 8 Apr 2019 10:31:10 +0200
From:   Maxime Ripard <maxime.ripard@...tlin.com>
To:     megous@...ous.com
Cc:     linux-sunxi@...glegroups.com, David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>, Chen-Yu Tsai <wens@...e.org>,
        "open list:DRM DRIVERS FOR ALLWINNER A10" 
        <dri-devel@...ts.freedesktop.org>,
        "moderated list:ARM/Allwinner sunXi SoC support" 
        <linux-arm-kernel@...ts.infradead.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] drm: sun4i: Fix NULL/invalid pointer dereference in
 sun8i_tcon_top_un/bind

On Sat, Apr 06, 2019 at 01:30:48AM +0200, megous@...ous.com wrote:
> From: Ondrej Jirman <megous@...ous.com>
>
> There are two problems here:
>
> 1. Not all clk_data->hws[] need to be initialized, depending on various
>    configured quirks. This leads to NULL ptr deref in
>    clk_hw_unregister_gate() in sun8i_tcon_top_unbind()
> 2. If there is error when registering the clk_data->hws[],
>    err_unregister_gates error path will try to unregister
>    IS_ERR()=true (invalid) pointer.
>
> For problem (1) I have this stack trace:
>
> Unable to handle kernel NULL pointer dereference at virtual
>   address 0000000000000008
> Call trace:
>  clk_hw_unregister+0x8/0x18
>  clk_hw_unregister_gate+0x14/0x28
>  sun8i_tcon_top_unbind+0x2c/0x60
>  component_unbind.isra.4+0x2c/0x50
>  component_bind_all+0x1d4/0x230
>  sun4i_drv_bind+0xc4/0x1a0
>  try_to_bring_up_master+0x164/0x1c0
>  __component_add+0xa0/0x168
>  component_add+0x10/0x18
>  sun8i_dw_hdmi_probe+0x18/0x20
>  platform_drv_probe+0x3c/0x70
>  really_probe+0xcc/0x278
>  driver_probe_device+0x34/0xa8
>
> Problem (2) was identified by head scratching.
>
> Signed-off-by: Ondrej Jirman <megous@...ous.com>

Changed the prefix to drm/sun4i: tcon top: and applied

Thanks!
Maxime

--
Maxime Ripard, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)