linux-kernel - Re: [PATCH v5 05/20] Input: axp20x-pek: Bail out if AXP has no interrupt line connected

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 28 Jan 2021 15:05:55 +0000
From:   Mark Brown <broonie@...nel.org>
To:     Andre Przywara <andre.przywara@....com>
Cc:     Dmitry Torokhov <dmitry.torokhov@...il.com>,
        Maxime Ripard <mripard@...nel.org>,
        Chen-Yu Tsai <wens@...e.org>,
        Jernej Skrabec <jernej.skrabec@...l.net>,
        Samuel Holland <samuel@...lland.org>,
        Icenowy Zheng <icenowy@...c.io>, Rob Herring <robh@...nel.org>,
        Clément Péron <peron.clem@...il.com>,
        Shuosheng Huang <huangshuosheng@...winnertech.com>,
        Yangtao Li <tiny.windzz@...il.com>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        linux-sunxi@...glegroups.com, Lee Jones <lee.jones@...aro.org>,
        linux-input@...r.kernel.org
Subject: Re: [PATCH v5 05/20] Input: axp20x-pek: Bail out if AXP has no
 interrupt line connected

On Thu, Jan 28, 2021 at 12:31:36PM +0000, Andre Przywara wrote:
> Mark Brown <broonie@...nel.org> wrote:

> > It sounds like you're trying to register an IRQ chip with a somehow
> > bogus configuration?

> I patched the AXP MFD driver [1] to skip the regmap-irq creation when no
> interrupts DT property was found, but this NULL pointer now
> understandably confuses the -pek driver, and leads to this crash:

> http://lists.infradead.org/pipermail/linux-arm-kernel/2021-January/634969.html

> Hence I wanted to plug this hole, which seems useful regardless of this
> particular issue.

The driver code here looks pretty confused.  It appears to be looking up
the interrupt to use from a resource (which is what I'd expect for a MFD
child) then for reasons I can't fathom trying to pass that resource into
regmap_irq_get_virq() which is at best going to just return the value
that was passed in but may potentially end up just returning a random
interrupt other than the one that was asked for since we're passing in a
global interrupt number rather than a controller relative one.  I really
can't tell what's supposed to be going on there.  A driver should either
use resources or it should use regmap_irq_get_virq(), using both is a
bug.

The MFD for this device is also just plain buggy in that it is providing
IRQ resources to the children when there is in fact no support for the
interrupts on the device in the system.  This means that the MFD core
sees that it has no interrupt domain, assumes that those interrupt
resources are in fact absolute interrupt numbers and passes them
straight through to the children.  This means that the children will
just be requesting random interrupts in the system which may actually
exist and be requestable which probably isn't going to end well.  When
there is no interrupt controller the parent should not be trying to
supply interrupt resources to the children at all.

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)