linux-kernel - Re: [PATCH v2] PCI: designware-ep: Fix the reference to pci->num_{ib,ob}

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAL_JsqLtcXFktBWWqpbYf3B5BR2eUyBsQQ3Q5S3Ma8hn5T5Z0Q@mail.gmail.com>
Date:   Wed, 20 Jan 2021 09:20:07 -0600
From:   Rob Herring <robh@...nel.org>
To:     Kunihiko Hayashi <hayashi.kunihiko@...ionext.com>
Cc:     Jingoo Han <jingoohan1@...il.com>,
        Gustavo Pimentel <gustavo.pimentel@...opsys.com>,
        Lorenzo Pieralisi <lorenzo.pieralisi@....com>,
        Bjorn Helgaas <bhelgaas@...gle.com>,
        PCI <linux-pci@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Jassi Brar <jaswinder.singh@...aro.org>,
        Masami Hiramatsu <masami.hiramatsu@...aro.org>
Subject: Re: [PATCH v2] PCI: designware-ep: Fix the reference to
 pci->num_{ib,ob}_windows before setting

On Mon, Jan 18, 2021 at 5:10 PM Kunihiko Hayashi
<hayashi.kunihiko@...ionext.com> wrote:
>
> The commit 281f1f99cf3a ("PCI: dwc: Detect number of iATU windows") gets
> the values of pci->num_ib_windows and pci->num_ob_windows from iATU
> registers instead of DT properties in dw_pcie_iatu_detect_regions*() or its
> unroll version.
>
> However, before the values are set, the allocations in dw_pcie_ep_init()
> refer them to determine the sizes of window_map. As a result, null pointer
> dereference exception will occur when linking the EP function and the
> controller.
>
>   # ln -s functions/pci_epf_test/test controllers/66000000.pcie-ep/
>   Unable to handle kernel NULL pointer dereference at virtual address
>   0000000000000010
>
> The call trace is as follows:
>
>   Call trace:
>    _find_next_bit.constprop.1+0xc/0x88
>    dw_pcie_ep_set_bar+0x78/0x1f8
>    pci_epc_set_bar+0x9c/0xe8
>    pci_epf_test_core_init+0xe8/0x220
>    pci_epf_test_bind+0x1e0/0x378
>    pci_epf_bind+0x54/0xb0
>    pci_epc_epf_link+0x58/0x80
>    configfs_symlink+0x1c0/0x570
>    vfs_symlink+0xdc/0x198
>    do_symlinkat+0xa0/0x110
>    __arm64_sys_symlinkat+0x28/0x38
>    el0_svc_common+0x84/0x1a0
>    do_el0_svc+0x38/0x88
>    el0_svc+0x1c/0x28
>    el0_sync_handler+0x88/0xb0
>    el0_sync+0x140/0x180
>
> The pci->num_{ib,ob}_windows should be referenced after they are set by
> dw_pcie_iatu_detect_regions*() called from dw_pcie_setup().
>
> Cc: Rob Herring <robh@...nel.org>
> Fixes: 281f1f99cf3a ("PCI: dwc: Detect number of iATU windows")
> Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@...ionext.com>
> ---
>  drivers/pci/controller/dwc/pcie-designware-ep.c | 41 ++++++++++++-------------
>  1 file changed, 20 insertions(+), 21 deletions(-)

Reviewed-by: Rob Herring <robh@...nel.org>