linux-kernel - Re: [PATCH v2] pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACRpkdYor2+rCZGsZLw=_Wna=0KnyXBaVtx-VahmN6Ky-zZ-Dg@mail.gmail.com>
Date: Wed, 21 May 2025 00:42:01 +0200
From: Linus Walleij <linus.walleij@...aro.org>
To: Nícolas F. R. A. Prado <nfraprado@...labora.com>
Cc: Sean Wang <sean.wang@...nel.org>, Matthias Brugger <matthias.bgg@...il.com>, 
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>, 
	Hao Chang <ot_chhao.chang@...iatek.com>, Qingliang Li <qingliang.li@...iatek.com>, 
	kernel@...labora.com, linux-mediatek@...ts.infradead.org, 
	linux-gpio@...r.kernel.org, linux-kernel@...r.kernel.org, 
	linux-arm-kernel@...ts.infradead.org, 
	Uwe Kleine-König <u.kleine-koenig@...libre.com>, 
	Chen-Yu Tsai <wenst@...omium.org>
Subject: Re: [PATCH v2] pinctrl: mediatek: eint: Fix invalid pointer
 dereference for v1 platforms

On Tue, May 20, 2025 at 11:16 PM Nícolas F. R. A. Prado
<nfraprado@...labora.com> wrote:

> Commit 3ef9f710efcb ("pinctrl: mediatek: Add EINT support for multiple
> addresses") introduced an access to the 'soc' field of struct
> mtk_pinctrl in mtk_eint_do_init() and for that an include of
> pinctrl-mtk-common-v2.h.
>
> However, pinctrl drivers relying on the v1 common driver include
> pinctrl-mtk-common.h instead, which provides another definition of
> struct mtk_pinctrl that does not contain an 'soc' field.
>
> Since mtk_eint_do_init() can be called both by v1 and v2 drivers, it
> will now try to dereference an invalid pointer when called on v1
> platforms. This has been observed on Genio 350 EVK (MT8365), which
> crashes very early in boot (the kernel trace can only be seen with
> earlycon).
>
> In order to fix this, since 'struct mtk_pinctrl' was only needed to get
> a 'struct mtk_eint_pin', make 'struct mtk_eint_pin' a parameter
> of mtk_eint_do_init() so that callers need to supply it, removing
> mtk_eint_do_init()'s dependency on any particular 'struct mtk_pinctrl'.
>
> Fixes: 3ef9f710efcb ("pinctrl: mediatek: Add EINT support for multiple addresses")
> Suggested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>
> Signed-off-by: Nícolas F. R. A. Prado <nfraprado@...labora.com>

Patch applied for v6.16.

If it is needed for v6.15- then I think at this point it will need to
be backported to stable. It also does not apply cleanly on Torvald's
tree, just on my devel branch.

Yours,
Linus Walleij