linux-kernel - [PATCH] genirq/irqdomain: Check for NULL in irq_domain_alloc_irqs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri,  6 Mar 2020 18:47:20 +0100
From:   Alexander A Sverdlin <alexander.sverdlin@...ia.com>
To:     linux-kernel@...r.kernel.org
Cc:     Alexander Sverdlin <alexander.sverdlin@...ia.com>,
        Marc Zyngier <maz@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>
Subject: [PATCH] genirq/irqdomain: Check for NULL in irq_domain_alloc_irqs_hierarchy()

From: Alexander Sverdlin <alexander.sverdlin@...ia.com>

irq_domain_alloc_irqs_hierarchy() has 3 call sites in the compilation unit
but only one of them checks for the pointer which is being dereferenced
inside the called function. Move the check into the function. This allows
for catching the error instead of the following crash:

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = 1845a981
[00000000] *pgd=0669c003, *pmd=1f83ff003
Internal error: Oops: 80000207 [#1] PREEMPT SMP THUMB2
Modules linked in: ...
CPU: 4 PID: 3665 Comm: modprobe Tainted: G        W  O      5.4.15-... #1
Hardware name: LSI Axxia AXM55XX
PC is at 0x0
LR is at gpiochip_hierarchy_irq_domain_alloc+0x11f/0x140
pc : [<00000000>]    lr : [<c06c23ff>]    psr: 200e0013
sp : c68d5c10  ip : 00000000  fp : d5589900
r10: 00000001  r9 : c68d5c34  r8 : 000002f8
r7 : d60dfe48  r6 : d60a8880  r5 : c06c1899  r4 : c0e04cc8
r3 : c68d5c34  r2 : 00000001  r1 : 000002f8  r0 : e0818800
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 70c5387d  Table: 077d4b00  DAC: 55555555
Process modprobe (pid: 3665, stack limit = 0xd2112104)
Stack: (0xc68d5c10 to 0xc68d6000)
...
[<c06c23ff>] (gpiochip_hierarchy_irq_domain_alloc) from [<c0462a89>] (__irq_domain_alloc_irqs+0xe1/0x24c)
[<c0462a89>] (__irq_domain_alloc_irqs) from [<c0462dad>] (irq_create_fwspec_mapping+0x75/0x194)
[<c0462dad>] (irq_create_fwspec_mapping) from [<c06c2251>] (gpiochip_to_irq+0x5d/0x68)
[<c06c2251>] (gpiochip_to_irq) from [<c06c1c9b>] (gpiod_to_irq+0x2b/0x3c)
[<c06c1c9b>] (gpiod_to_irq) from [<bf973073>] (gpio_irqs_init+0x67/0x170 [gpio_irqs])
[<bf973073>] (gpio_irqs_init [gpio_irqs]) from [<bf974048>] (gpio_irqs_exit+0xecc/0xe84 [gpio_irqs])
Code: bad PC value

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@...ia.com>
---
 kernel/irq/irqdomain.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index c1f8fa4..7496eb1 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1326,6 +1326,11 @@ int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
 				    unsigned int irq_base,
 				    unsigned int nr_irqs, void *arg)
 {
+	if (!domain->ops->alloc) {
+		pr_debug("domain->ops->alloc() is NULL\n");
+		return -ENOSYS;
+	}
+
 	return domain->ops->alloc(domain, irq_base, nr_irqs, arg);
 }
 
@@ -1363,11 +1368,6 @@ int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base,
 			return -EINVAL;
 	}
 
-	if (!domain->ops->alloc) {
-		pr_debug("domain->ops->alloc() is NULL\n");
-		return -ENOSYS;
-	}
-
 	if (realloc && irq_base >= 0) {
 		virq = irq_base;
 	} else {
-- 
2.4.6