lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 13 Jan 2021 10:35:06 +0530 From: Kishon Vijay Abraham I <kishon@...com> To: Shradha Todi <shradha.t@...sung.com>, <linux-kernel@...r.kernel.org>, <linux-pci@...r.kernel.org> CC: <bhelgaas@...gle.com>, <lorenzo.pieralisi@....com>, <pankaj.dubey@...sung.com>, <sriram.dash@...sung.com>, <niyas.ahmed@...sung.com>, <p.rajanbabu@...sung.com>, <l.mehra@...sung.com>, <hari.tv@...sung.com> Subject: Re: [PATCH v4] PCI: endpoint: Fix NULL pointer dereference for ->get_features() On 12/01/21 7:32 pm, Shradha Todi wrote: > get_features ops of pci_epc_ops may return NULL, causing NULL pointer > dereference in pci_epf_test_bind function. Let us add a check for > pci_epc_feature pointer in pci_epf_test_bind before we access it to avoid > any such NULL pointer dereference and return -ENOTSUPP in case > pci_epc_feature is not found. > > When the patch is not applied and EPC features is not implemented in the > platform driver, we see the following dump due to kernel NULL pointer > dereference. > > [ 105.135936] Call trace: > [ 105.138363] pci_epf_test_bind+0xf4/0x388 > [ 105.142354] pci_epf_bind+0x3c/0x80 > [ 105.145817] pci_epc_epf_link+0xa8/0xcc > [ 105.149632] configfs_symlink+0x1a4/0x48c > [ 105.153616] vfs_symlink+0x104/0x184 > [ 105.157169] do_symlinkat+0x80/0xd4 > [ 105.160636] __arm64_sys_symlinkat+0x1c/0x24 > [ 105.164885] el0_svc_common.constprop.3+0xb8/0x170 > [ 105.169649] el0_svc_handler+0x70/0x88 > [ 105.173377] el0_svc+0x8/0x640 > [ 105.176411] Code: d2800581 b9403ab9 f9404ebb 8b394f60 (f9400400) > [ 105.182478] ---[ end trace a438e3c5a24f9df0 ]--- > > Fixes: 2c04c5b8eef79 ("PCI: pci-epf-test: Use pci_epc_get_features() to get EPC features") > Reviewed-by: Pankaj Dubey <pankaj.dubey@...sung.com> > Signed-off-by: Sriram Dash <sriram.dash@...sung.com> > Signed-off-by: Shradha Todi <shradha.t@...sung.com> Reviewed-by: Kishon Vijay Abraham I <kishon@...com> > --- > drivers/pci/endpoint/functions/pci-epf-test.c | 13 ++++++++----- > 1 file changed, 8 insertions(+), 5 deletions(-) > > diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c > index e4e51d8..1b30774 100644 > --- a/drivers/pci/endpoint/functions/pci-epf-test.c > +++ b/drivers/pci/endpoint/functions/pci-epf-test.c > @@ -830,13 +830,16 @@ static int pci_epf_test_bind(struct pci_epf *epf) > return -EINVAL; > > epc_features = pci_epc_get_features(epc, epf->func_no); > - if (epc_features) { > - linkup_notifier = epc_features->linkup_notifier; > - core_init_notifier = epc_features->core_init_notifier; > - test_reg_bar = pci_epc_get_first_free_bar(epc_features); > - pci_epf_configure_bar(epf, epc_features); > + if (!epc_features) { > + dev_err(&epf->dev, "epc_features not implemented\n"); > + return -EOPNOTSUPP; > } > > + linkup_notifier = epc_features->linkup_notifier; > + core_init_notifier = epc_features->core_init_notifier; > + test_reg_bar = pci_epc_get_first_free_bar(epc_features); > + pci_epf_configure_bar(epf, epc_features); > + > epf_test->test_reg_bar = test_reg_bar; > epf_test->epc_features = epc_features; > >
Powered by blists - more mailing lists