linux-kernel - [PATCH] regulator: da9063: fix null pointer deref with partial DT config

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230616143736.2946173-1-martin.fuzzey@flowbird.group>
Date:   Fri, 16 Jun 2023 16:36:28 +0200
From:   Martin Fuzzey <martin.fuzzey@...wbird.group>
To:     Mark Brown <broonie@...nel.org>
Cc:     Support Opensource <support.opensource@...semi.com>,
        Benjamin Bara <benjamin.bara@...data.com>,
        Adam Ward <DLG-Adam.Ward.opensource@...renesas.com>,
        linux-kernel@...r.kernel.org
Subject: [PATCH] regulator: da9063: fix null pointer deref with partial DT config

When some of the da9063 regulators do not have corresponding DT nodes
a null pointer dereference occurs on boot:

[    1.559034] 8<--- cut here ---
[    1.564014] Unable to handle kernel NULL pointer dereference at virtual address 00000098 when read
[    1.578055] [00000098] *pgd=00000000
[    1.593575] Internal error: Oops: 5 [#1] SMP ARM
[    1.634870] PC is at da9063_regulator_probe+0x35c/0x788
[    1.647934] LR is at da9063_regulator_probe+0x2e8/0x788
[    2.073626]  da9063_regulator_probe from platform_probe+0x58/0xb8
[    2.079759]  platform_probe from really_probe+0xd8/0x3c0
[    2.085092]  really_probe from __driver_probe_device+0x94/0x1e8
[    2.091026]  __driver_probe_device from driver_probe_device+0x2c/0xd0
[    2.097479]  driver_probe_device from __device_attach_driver+0xa4/0x11c
[    2.104107]  __device_attach_driver from bus_for_each_drv+0x84/0xdc
[    2.110402]  bus_for_each_drv from __device_attach_async_helper+0xb0/0x110
[    2.117295]  __device_attach_async_helper from async_run_entry_fn+0x3c/0x158
[    2.124369]  async_run_entry_fn from process_one_work+0x1d4/0x3e4
[    2.130485]  process_one_work from worker_thread+0x30/0x520
[    2.136070]  worker_thread from kthread+0xdc/0xfc

This is because such regulators have no init_data causing the pointers
calculated in da9063_check_xvp_constraints() to be invalid.

Do not dereference them in this case.

Fixes: b8717a80e6ee ("regulator: da9063: implement setter for voltage monitoring")
Signed-off-by: Martin Fuzzey <martin.fuzzey@...wbird.group>
---
 drivers/regulator/da9063-regulator.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/regulator/da9063-regulator.c b/drivers/regulator/da9063-regulator.c
index c5dd77be558b..dfd5ec9f75c9 100644
--- a/drivers/regulator/da9063-regulator.c
+++ b/drivers/regulator/da9063-regulator.c
@@ -778,6 +778,9 @@ static int da9063_check_xvp_constraints(struct regulator_config *config)
 	const struct notification_limit *uv_l = &constr->under_voltage_limits;
 	const struct notification_limit *ov_l = &constr->over_voltage_limits;
 
+	if (!config->init_data) /* No config in DT, pointers will be invalid */
+		return 0;
+
 	/* make sure that only one severity is used to clarify if unchanged, enabled or disabled */
 	if ((!!uv_l->prot + !!uv_l->err + !!uv_l->warn) > 1) {
 		dev_err(config->dev, "%s: at most one voltage monitoring severity allowed!\n",
-- 
2.25.1